sshd.c in OpenSSH 3.6.1p2 and 3.7.1p2 and possibly other versions, when using privilege separation, does not properly signal the…

Description

sshd.c in OpenSSH 3.6.1p2 and 3.7.1p2 and possibly other versions, when using privilege separation, does not properly signal the non-privileged process when a session has been terminated after exceeding the LoginGraceTime setting, which leaves the connection open and allows remote attackers to cause a denial of service (connection consumption).

Scores

EPSS (exploitation in 30 days)

3.4% · top 11% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.

Weakness

• n/a

Affected products

• n/a

  • affected n/a

References (23)

• http://support.avaya.com/elmodocs2/security/ASA-2005-216.pdf (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• ADV-2006-4502 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• [openssh-unix-dev] 20040127 OpenSSH - Connection problem when LoginGraceTime exceeds time (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• 16567 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 22875 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 23680 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• openssh-sshdc-logingracetime-dos(20930) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• http://www.vmware.com/download/esx/esx-202-200610-patch.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• 20061113 VMSA-2006-0008 - VMware ESX Server 2.0.2 Upgrade Patch 2 (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• FLSA-2006:168935 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• http://www.vmware.com/download/esx/esx-213-200610-patch.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• [openssh-unix-dev] 20040128 Re: OpenSSH - Connection problem when LoginGraceTime exceeds time (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• http://support.avaya.com/elmodocs2/security/ASA-2005-223.pdf (opens in a new tab)x_refsource_CONFIRMx_transferred
• 17000 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 14963 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• 17252 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 17135 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 20061113 VMSA-2006-0006 - VMware ESX Server 2.5.3 Upgrade Patch 4 (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• oval:org.mitre.oval:def:11541 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• RHSA-2005:550 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• 20061113 VMSA-2006-0007 - VMware ESX Server 2.1.3 Upgrade Patch 2 (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2004-2069](https://trackcve.app/badge/CVE-2004-2069.svg)](https://trackcve.app/cve/CVE-2004-2069)

Record last updated 8 Aug 2024, 01:15 UTC.