CVE-2006-5051: Race Condition
OpenSSH 4.4 was released and mentions:
Fix an unsafe signal hander reported by Mark Dowd. The signal handler was vulnerable to a race condition that could be exploited to perform a pre-authentication denial of service. On portable OpenSSH, this vulnerability could theoretically lead to pre-authentication remote code execution if GSSAPI authentication is enabled, but the likelihood of successful exploitation appears remote.
This could only affect RHEL4 as previous RHEL did not support GSSAPI
Other sources
Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-5051?
CVE-2006-5051 is classified as a medium severity vulnerability due to its potential for a pre-authentication denial of service.
How do I fix CVE-2006-5051?
To mitigate CVE-2006-5051, update OpenSSH to a version beyond 4.4, which contains the necessary patches.
What versions of OpenSSH are affected by CVE-2006-5051?
Affected versions include OpenSSH 4.4 and earlier, along with various earlier versions from the 3.x series and below.
Can CVE-2006-5051 lead to an actual exploit?
Yes, it can be exploited to create a denial of service condition, affecting the availability of the affected systems.
Is CVE-2006-5051 specific to any operating system?
CVE-2006-5051 impacts multiple operating systems that use vulnerable versions of OpenSSH, including Red Hat, Debian, and macOS.