CVE-2014-8475

FreeBSD 9.1, 9.2, and 10.0, when compiling OpenSSH with Kerberos support, uses incorrect library ordering when linking sshd, which causes symbols to be resolved incorrectly and allows remote attackers to cause a denial of service (sshd deadlock and prevention of new connections) by ending multiple connections before authentication is completed.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 81%
VendorProductVersion
freebsdfreebsd
9.1
freebsdfreebsd
9.2
freebsdfreebsd
10.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
openssh
bullseye (security)
1:8.4p1-5+deb11u3
fixed
bullseye
1:8.4p1-5+deb11u3
fixed
bookworm
1:9.2p1-2+deb12u3
fixed
bookworm (security)
1:9.2p1-2+deb12u3
fixed
sid
1:9.9p1-3
fixed
trixie
1:9.9p1-3
fixed
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/128972/FreeBSD-Security-Advisory-sshd-Denial-Of-Service.html
http://secunia.com/advisories/61440
http://www.securityfocus.com/bid/70913
http://www.securitytracker.com/id/1031168
https://exchange.xforce.ibmcloud.com/vulnerabilities/98491
https://www.freebsd.org/security/advisories/FreeBSD-SA-14%3A24.sshd.asc
http://packetstormsecurity.com/files/128972/FreeBSD-Security-Advisory-sshd-Denial-Of-Service.html
http://secunia.com/advisories/61440
http://www.securityfocus.com/bid/70913
http://www.securitytracker.com/id/1031168
https://exchange.xforce.ibmcloud.com/vulnerabilities/98491
https://www.freebsd.org/security/advisories/FreeBSD-SA-14%3A24.sshd.asc