CVE-2006-4924

Severity: high (CVSS 7.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 38.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-09-27 · updated 2026-06-16
Weakness: CWE-399

Description

sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a denial of service (CPU consumption) via an SSH packet that contains duplicate blocks, which is not properly handled by the CRC compensation attack detector.

Affected products

OpenSSH: 1.2, 1.2.1, 1.2.2, 1.2.3, 1.2.27, 2.1 (+50)

References

http://blogs.sun.com/security/entry/sun_alert_102962_security_vulnerability
http://bugs.gentoo.org/show_bug.cgi?id=148228
http://docs.info.apple.com/article.html?artnum=305214
http://itrc.hp.com/service/cki/docDisplay.do?docId=c00815112
http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html
http://marc.info/?l=openssh-unix-dev&m=115939141729160&w=2
http://secunia.com/advisories/21923
http://secunia.com/advisories/22091
http://secunia.com/advisories/22116

Get alerted when CVE-2006-4924 or the next vulnerability affects your stack