Executive Summary

Informations
Name CVE-2010-5107 First vendor Publication 2013-03-07
Vendor Cve Last vendor Modification 2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5107

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:19515
 
Oval ID: oval:org.mitre.oval:def:19515
Title: AIX OpenSSH Vulnerability
Description: The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.
Family: unix Class: vulnerability
Reference(s): CVE-2010-5107
 Version: 5
Platform(s): IBM AIX 5.3
IBM AIX 6.1
IBM AIX 7.1
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19595
 
Oval ID: oval:org.mitre.oval:def:19595
Title: HP-UX Running HP Secure Shell, Remote Denial of Service (DoS)
Description: The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.
Family: unix Class: vulnerability
Reference(s): CVE-2010-5107
 Version: 12
Platform(s): HP-UX 11
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25710
 
Oval ID: oval:org.mitre.oval:def:25710
Title: SUSE-SU-2013:1345-1 -- Security update for OpenSSH
Description: This update for OpenSSH provides the following fixes: * Implement remote denial of service hardening. (bnc#802639, CVE-2010-5107) * Use only FIPS 140-2 approved algorithms when FIPS mode is detected. (bnc#755505, bnc#821039) * Do not link OpenSSH binaries with LDAP libraries. (bnc#826906) Security Issue reference: * CVE-2010-5107 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5107 >
Family: unix Class: patch
Reference(s): SUSE-SU-2013:1345-1
CVE-2010-5107
 Version: 3
Platform(s): SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Desktop 11
 Product(s): OpenSSH
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26218
 
Oval ID: oval:org.mitre.oval:def:26218
Title: RHSA-2012:0884: openssh security, bug fix, and enhancement update (Low)
Description: The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote authenticated users to cause a denial of service (memory consumption) via a large value in a certain length field. NOTE: there may be limited scenarios in which this issue is relevant.
Family: unix Class: patch
Reference(s): RHSA-2013:1591-02
CESA-2013:1591
CVE-2010-5107
 Version: 5
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
 Product(s): openssh
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27087
 
Oval ID: oval:org.mitre.oval:def:27087
Title: DEPRECATED: RHSA-2013:1591 -- openssh security, bug fix, and enhancement update (Low)
Description: OpenSSH is OpenBSD&#39;s Secure Shell (SSH) protocol implementation. These packages include the core files necessary for the OpenSSH client and server. The default OpenSSH configuration made it easy for remote attackers to exhaust unauthorized connection slots and prevent other users from being able to log in to a system. This flaw has been addressed by enabling random early connection drops by setting MaxStartups to 10:30:100 by default. For more information, refer to the sshd_config(5) man page. (CVE-2010-5107) These updated openssh packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical Notes, linked to in the References, for information on the most significant of these changes. All openssh users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.
Family: unix Class: patch
Reference(s): RHSA-2013:1591
CESA-2013:1591
CVE-2010-5107
 Version: 5
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
 Product(s): openssh
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27211
 
Oval ID: oval:org.mitre.oval:def:27211
Title: ELSA-2013-1591 -- openssh security, bug fix, and enhancement update (low)
Description: [5.3p1-94] - use dracut-fips package to determine if a FIPS module is installed (#1001565)
Family: unix Class: patch
Reference(s): ELSA-2013-1591
CVE-2010-5107
 Version: 3
Platform(s): Oracle Linux 6
 Product(s): openssh
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 123

Information Assurance Vulnerability Management (IAVM)

Date Description
2015-05-21 IAVM : 2015-A-0113 - Multiple Vulnerabilities in Juniper Networks CTPOS
Severity : Category I - VMSKEY : V0060737

Snort® IPS/IDS

Date Description
2015-04-02 OpenSSH maxstartup threshold potential connection exhaustion denial of servic...
RuleID : 33654 - Revision : 6 - Type : SERVER-OTHER

Nessus® Vulnerability Scanner

Date Description
2016-03-22 Name : The remote OracleVM host is missing one or more security updates.
File : oraclevm_OVMSA-2016-0038.nasl - Type : ACT_GATHER_INFO
2016-03-10 Name : The remote OracleVM host is missing one or more security updates.
File : oraclevm_OVMSA-2016-0033.nasl - Type : ACT_GATHER_INFO
2016-02-29 Name : The remote OracleVM host is missing one or more security updates.
File : oraclevm_OVMSA-2016-0030.nasl - Type : ACT_GATHER_INFO
2016-02-26 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2016-3521.nasl - Type : ACT_GATHER_INFO
2015-06-30 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL14741.nasl - Type : ACT_GATHER_INFO
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_ssh_20130716.nasl - Type : ACT_GATHER_INFO
2014-11-12 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-1591.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2013-1527.nasl - Type : ACT_GATHER_INFO
2014-05-12 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201405-06.nasl - Type : ACT_GATHER_INFO
2014-04-16 Name : The remote AIX host is running a vulnerable version of OpenSSH.
File : aix_openssh_advisory2.nasl - Type : ACT_GATHER_INFO
2013-12-04 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20131121_openssh_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2013-11-29 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1591.nasl - Type : ACT_GATHER_INFO
2013-11-21 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1591.nasl - Type : ACT_GATHER_INFO
2013-08-16 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_openssh-130716.nasl - Type : ACT_GATHER_INFO
2013-07-03 Name : The remote SSH service is susceptible to a remote denial of service attack.
File : openssh_logingrace_dos.nasl - Type : ACT_GATHER_INFO
2013-04-20 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2013-051.nasl - Type : ACT_GATHER_INFO
2013-02-26 Name : The remote Fedora host is missing a security update.
File : fedora_2013-2206.nasl - Type : ACT_GATHER_INFO
2013-02-13 Name : The remote Fedora host is missing a security update.
File : fedora_2013-2212.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

http://marc.info/?l=bugtraq&m=144050155601375&w=2
http://rhn.redhat.com/errata/RHSA-2013-1591.html
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/servconf.c?r1=1.234#rev...
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshd_config?r1=1.89#rev...
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshd_config.5?r1=1.156#...
http://www.openwall.com/lists/oss-security/2013/02/07/3
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-286720...
http://www.securityfocus.com/bid/58162
https://bugzilla.redhat.com/show_bug.cgi?id=908707
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
Date Informations
2024-11-28 22:58:01
  • Multiple Updates
2024-11-28 12:24:10
  • Multiple Updates
2024-08-02 12:15:23
  • Multiple Updates
2024-08-02 01:04:15
  • Multiple Updates
2024-02-02 01:14:56
  • Multiple Updates
2024-02-01 12:04:10
  • Multiple Updates
2023-09-05 12:13:58
  • Multiple Updates
2023-09-05 01:04:02
  • Multiple Updates
2023-09-02 12:14:01
  • Multiple Updates
2023-09-02 01:04:05
  • Multiple Updates
2023-08-12 12:16:49
  • Multiple Updates
2023-08-12 01:04:06
  • Multiple Updates
2023-08-11 12:14:06
  • Multiple Updates
2023-08-11 01:04:14
  • Multiple Updates
2023-08-06 12:13:32
  • Multiple Updates
2023-08-06 01:04:07
  • Multiple Updates
2023-08-04 12:13:37
  • Multiple Updates
2023-08-04 01:04:07
  • Multiple Updates
2023-07-14 12:13:35
  • Multiple Updates
2023-07-14 01:04:06
  • Multiple Updates
2023-03-29 01:15:32
  • Multiple Updates
2023-03-28 12:04:12
  • Multiple Updates
2022-10-11 12:12:07
  • Multiple Updates
2022-10-11 01:03:52
  • Multiple Updates
2022-08-05 12:10:56
  • Multiple Updates
2021-05-04 12:13:28
  • Multiple Updates
2021-04-22 01:13:47
  • Multiple Updates
2020-07-25 12:05:42
  • Multiple Updates
2020-05-23 01:43:31
  • Multiple Updates
2020-05-23 00:27:23
  • Multiple Updates
2019-10-09 01:03:48
  • Multiple Updates
2017-09-19 09:24:07
  • Multiple Updates
2016-11-29 00:24:46
  • Multiple Updates
2016-10-12 09:24:02
  • Multiple Updates
2016-08-23 09:24:41
  • Multiple Updates
2016-06-17 09:26:32
  • Multiple Updates
2016-04-26 20:24:20
  • Multiple Updates
2016-03-23 13:26:10
  • Multiple Updates
2016-03-11 13:26:30
  • Multiple Updates
2016-03-01 13:26:32
  • Multiple Updates
2016-02-27 13:27:00
  • Multiple Updates
2015-10-18 17:22:15
  • Multiple Updates
2015-07-01 13:27:48
  • Multiple Updates
2015-04-15 09:27:15
  • Multiple Updates
2015-04-02 21:27:06
  • Multiple Updates
2015-01-22 17:22:29
  • Multiple Updates
2015-01-21 13:24:44
  • Multiple Updates
2014-11-13 13:26:33
  • Multiple Updates
2014-11-08 13:29:45
  • Multiple Updates
2014-05-13 13:24:57
  • Multiple Updates
2014-04-17 13:25:36
  • Multiple Updates
2014-02-17 10:59:12
  • Multiple Updates
2014-01-14 13:19:46
  • Multiple Updates
2013-12-05 17:19:06
  • Multiple Updates
2013-05-10 23:40:57
  • Multiple Updates
2013-03-08 21:19:29
  • Multiple Updates
2013-03-08 00:19:02
  • First insertion