CVE-2006-4924 in the critical feed json
sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a denial of service (CPU consumption) v…
published 2006-09-27 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-4911
- cvss
- 7.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 38.1%
- EPSS 38.1% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Exploit-DB
Summary
sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a denial of service (CPU consumption) via an SSH packet that contains duplicate blocks, which is not properly handled by the CRC compensation attack detector.
Patch / fix
- openssh Debian 14, Debian 13, Debian 12 1:4.3p2-4
debian advisories DEBIAN-CVE-2006-4924
- openssh RHEL 2.1 3.1p1-21
- openssh-server RHEL 2.1 3.1p1-21
- openssh-askpass RHEL 2.1 3.1p1-21
- openssh-clients RHEL 2.1 3.1p1-21
- openssh-askpass-gnome RHEL 2.1 3.1p1-21
- openssh RHEL 3 3.6.1p2-33.30.12
- openssh RHEL 4 3.9p1-8.RHEL4.17
- openssh-server RHEL 3 3.6.1p2-33.30.12
red hat advisories RHSA-2006:0698RHSA-2006:0697
- securityfocus.com/bid/20216 patch
- debian.org/security/2006/dsa-1212 advisory
- debian.org/security/2006/dsa-1189 advisory
- bugzilla.redhat.com/bugzilla/show_bug.cgi?id=207955 advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2006-4924 updated
openssh DoS
-
Red Hat Desktop version 3 openssh 3.6.1p2-33.30.12, openssh-server 3.6.1p2-33.30.12, openssh-askpass 3.6.1p2-33.30.12, openssh-clients 3.6.1p2-33.30.12, openssh-askpass-gnome 3.6.1p2-33.30.12fixed: vendor fix RHSA-2006:0697
-
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 openssh 3.1p1-21, openssh-server 3.1p1-21, openssh-askpass 3.1p1-21, openssh-clients 3.1p1-21, openssh-askpass-gnome 3.1p1-21fixed: vendor fix RHSA-2006:0698
-
Red Hat Enterprise Linux AS version 3 openssh 3.6.1p2-33.30.12, openssh-server 3.6.1p2-33.30.12, openssh-askpass 3.6.1p2-33.30.12, openssh-clients 3.6.1p2-33.30.12, openssh-askpass-gnome 3.6.1p2-33.30.12 Red Hat Enterprise Linux AS version 4 openssh 3.9p1-8.RHEL4.17, openssh-server 3.9p1-8.RHEL4.17, openssh-askpass 3.9p1-8.RHEL4.17, openssh-clients 3.9p1-8.RHEL4.17, openssh-askpass-gnome 3.9p1-8.RHEL4.17 Red Hat Enterprise Linux Desktop version 4 openssh 3.9p1-8.RHEL4.17, openssh-server 3.9p1-8.RHEL4.17, openssh-askpass 3.9p1-8.RHEL4.17, openssh-clients 3.9p1-8.RHEL4.17, openssh-askpass-gnome 3.9p1-8.RHEL4.17fixed: vendor fix RHSA-2006:0697
-
Red Hat Enterprise Linux ES version 2.1 openssh 3.1p1-21, openssh-server 3.1p1-21, openssh-askpass 3.1p1-21, openssh-clients 3.1p1-21, openssh-askpass-gnome 3.1p1-21fixed: vendor fix RHSA-2006:0698
-
Red Hat Enterprise Linux ES version 3 openssh 3.6.1p2-33.30.12, openssh-server 3.6.1p2-33.30.12, openssh-askpass 3.6.1p2-33.30.12, openssh-clients 3.6.1p2-33.30.12, openssh-askpass-gnome 3.6.1p2-33.30.12 Red Hat Enterprise Linux ES version 4 openssh 3.9p1-8.RHEL4.17, openssh-server 3.9p1-8.RHEL4.17, openssh-askpass 3.9p1-8.RHEL4.17, openssh-clients 3.9p1-8.RHEL4.17, openssh-askpass-gnome 3.9p1-8.RHEL4.17fixed: vendor fix RHSA-2006:0697
-
Red Hat Enterprise Linux WS version 2.1 openssh 3.1p1-21, openssh-server 3.1p1-21, openssh-askpass 3.1p1-21, openssh-clients 3.1p1-21, openssh-askpass-gnome 3.1p1-21fixed: vendor fix RHSA-2006:0698
-
Red Hat Enterprise Linux WS version 3 openssh 3.6.1p2-33.30.12, openssh-server 3.6.1p2-33.30.12, openssh-askpass 3.6.1p2-33.30.12, openssh-clients 3.6.1p2-33.30.12, openssh-askpass-gnome 3.6.1p2-33.30.12 Red Hat Enterprise Linux WS version 4 openssh 3.9p1-8.RHEL4.17, openssh-server 3.9p1-8.RHEL4.17, openssh-askpass 3.9p1-8.RHEL4.17, openssh-clients 3.9p1-8.RHEL4.17, openssh-askpass-gnome 3.9p1-8.RHEL4.17fixed: vendor fix RHSA-2006:0697
-
Red Hat Linux Advanced Workstation 2.1 openssh 3.1p1-21, openssh-server 3.1p1-21, openssh-askpass 3.1p1-21, openssh-clients 3.1p1-21, openssh-askpass-gnome 3.1p1-21fixed: vendor fix RHSA-2006:0698
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (EDB-2444)
- Published
Exploit prediction
38.12% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-2444 OpenSSH 4.3 p1 - Duplicated Block Remote Denial of Service dos, 2006-09-27
- securityfocus.com http://www.securityfocus.com/bid/20216 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.8 | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Classification
- Weakness
-
- CWE-399 Resource Management Errors
References
-
debian.org
/security/2006/dsa-1212
vendor-advisory, patch
-
debian.org
/security/2006/dsa-1189
vendor-advisory, patch
-
securityfocus.com
/bid/20216
exploit, patch
-
bugzilla.redhat.com
/bugzilla/show_bug.cgi?id=207955
patch, vendor-advisory
-
security.freebsd.org
/advisories/FreeBSD-SA-06%3A22.openssh.asc
vendor-advisory
-
itrc.hp.com
/service/cki/docDisplay.do?docId=c00815112
vendor-advisory
-
ubuntu.com
/usn/usn-355-1
vendor-advisory
-
trustix.org
/errata/2006/0054
vendor-advisory
-
openbsd.org
/errata.html#ssh
vendor-advisory
-
novell.com
/linux/security/advisories/2006_24_sr.html
vendor-advisory
-
security.gentoo.org
/glsa/glsa-200611-06.xml
vendor-advisory
-
sunsolve.sun.com
/search/document.do?assetkey=1-26-102962-1
vendor-advisory
-
novell.com
/linux/security/advisories/2006_62_openssh.html
vendor-advisory
-
lists.apple.com
/archives/security-announce/2007/Mar/msg00002.html
vendor-advisory
-
security.gentoo.org
/glsa/glsa-200609-17.xml
vendor-advisory
-
slackware.com
/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.592566
vendor-advisory
-
redhat.com
/support/errata/RHSA-2006-0697.html
vendor-advisory
-
openpkg.org
/security/advisories/OpenPKG-SA-2006.022-openssh.html
vendor-advisory
-
redhat.com
/support/errata/RHSA-2006-0698.html
vendor-advisory
-
mandriva.com
/security/advisories?name=MDKSA-2006:179
vendor-advisory
-
secunia.com
/advisories/22270
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/23038
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/22116
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/21923
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/23340
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/22487
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/22164
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/22362
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/22091
vendor-advisory
-
secunia.com
/advisories/22158
vendor-advisory
-
secunia.com
/advisories/22183
vendor-advisory
-
secunia.com
/advisories/22196
vendor-advisory
-
secunia.com
/advisories/22208
vendor-advisory
-
secunia.com
/advisories/22236
vendor-advisory
-
secunia.com
/advisories/22245
vendor-advisory
-
secunia.com
/advisories/22298
vendor-advisory
-
secunia.com
/advisories/22352
vendor-advisory
-
secunia.com
/advisories/22495
vendor-advisory
-
secunia.com
/advisories/22823
vendor-advisory
-
secunia.com
/advisories/22926
vendor-advisory
-
secunia.com
/advisories/23241
vendor-advisory
- sourceforge.net /forum/forum.php?forum_id=681763
- blogs.sun.com /security/entry/sun_alert_102962_security_vulnerability
- vmware.com /support/vi3/doc/esx-3069097-patch.html
-
vupen.com
/english/advisories/2006/4401
vdb-entry
- sourceforge.net /project/shownotes.php?release_id=461863&group_id=69227
-
vupen.com
/english/advisories/2009/0740
vdb-entry
-
secunia.com
/advisories/24805
third-party-advisory
-
us-cert.gov
/cas/techalerts/TA07-072A.html
third-party-advisory
- support.avaya.com /elmodocs2/security/ASA-2006-262.htm
- bugs.gentoo.org /show_bug.cgi?id=148228
-
secunia.com
/advisories/23680
third-party-advisory
-
secunia.com
/advisories/34274
third-party-advisory
-
kb.cert.org
/vuls/id/787448
third-party-advisory
- docs.info.apple.com /article.html?artnum=305214
- marc.info /?l=openssh-unix-dev&m=115939141729160&w=2
- secunia.com /advisories/24479
- secunia.com /advisories/24799
- secunia.com /advisories/25608
- secunia.com /advisories/29371
Sources
- CVE List CVE-2006-4924
- NVD CVE-2006-4924
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.