PT-2016-3241 · Openssh+7 · Openssh+7

Kashinath T · Published 2016-03-09 · Updated 2025-09-29 · CVE-2016-6515

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 7.3

Description The issue is related to the auth password function in auth-passwd.c in sshd, which does not limit password lengths for password authentication. This allows remote attackers to cause a denial of service (consumption of CPU resources) via a long string.

Recommendations For OpenSSH versions prior to 7.3, consider updating to version 7.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of long password strings to minimize the risk of exploitation.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2024_1130

ALSA-2024_1150

ALSA-2025_16880

ALT-PU-2016-1200

ALT-PU-2024-3921

ALT-PU-2024-4077

ALT-PU-2024-4467

ALT-PU-2024-9513

BDU:2018-00117

CESA-2017_2029

CVE-2016-6515

DLA-1500-1

DLA-594-1

ELSA-2017-2029

FREEBSD-SA-17_06

MGASA-2016-0280

OPENSUSE-SU-2024:10174-1

RHSA-2017:2029

RHSA-2017_2029

SUSE-SU-2016:2280-1

SUSE-SU-2016:2281-1

SUSE-SU-2016:2388-1

SUSE-SU-2016:2555-1

USN-3061-1

Affected Products

Alt Linux

Centos

Freebsd

Ibm Aix

Openssh

Red Hat

Suse

Ubuntu

References · 74

• 🔥 https://github.com/opsxcq/exploit-CVE-2016-6515 · Exploit
• 🔥 https://exploit-db.com/exploits/40888 · Exploit
• https://github.com/openssh/openssh-portable/commit/fcd135c9df440bcd2d5870405ad3311743d78d97 · Patch
• https://security.freebsd.org/advisories/FreeBSD-SA-17:06.openssh.asc · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-6515 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0280.html · Security Note
• https://bdu.fstec.ru/vul/2018-00117 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:2280-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2029 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2388-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-6515 · Vendor Advisory
• https://debian.org/security/2016/dsa-3550 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2555-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2016-6515 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6210 · Vendor Advisory