Description
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | 1:6.9p1-1 | — |
| Debian 13 | openssh | 1:6.9p1-1 | — |
| Debian 12 | openssh | 1:6.9p1-1 | — |
| Debian 8 | openssh | 1:6.7p1-5+deb8u6 | DLA-1500-1 |
| Debian 6.0 | openssh | 1:5.5p1-6+squeeze6 | DLA-288-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | openssh | 1:6.6p1-2ubuntu2.2 | USN-2710-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | openssh +6 | 6.6.1p1-22.el7 | RHSA-2015:2088 |
| RHEL 7 | pam_ssh_agent_auth | 0.9.3-9.22.el7 | RHSA-2015:2088 |
| RHEL 6 | openssh +4 | 5.3p1-114.el6_7 | RHSA-2016:0466 |
| RHEL 6 | pam_ssh_agent_auth | 0.9.3-114.el6_7 | RHSA-2016:0466 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | openssh +1 | 6.6p1-29.1 | SUSE-SU-2015:1544-1 |
| SLES 11 SP4 | openssh | 6.6p1-13.1 | SUSE-SU-2015:1695-1 |
| SLES 11 SP4 | openssh-askpass-gnome | 6.6p1-13.3 | SUSE-SU-2015:1695-1 |
| SLES 11 SP3 | openssh | 6.2p2-0.21.1 | SUSE-SU-2015:1581-1 |
| SLES 11 SP3 | openssh-askpass-gnome | 6.2p2-0.21.3 | SUSE-SU-2015:1581-1 |
| SLES 11 SP2 | openssh | 5.1p1-41.69.1 | SUSE-SU-2015:1840-1 |
| SLES 11 SP2 | openssh-askpass-gnome | 5.1p1-41.69.4 | SUSE-SU-2015:1840-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 | openssh +1 | 6.6p1-29.1 | SUSE-SU-2015:1544-1 |
| SLES for SAP 11 SP4 | openssh | 6.6p1-13.1 | SUSE-SU-2015:1695-1 |
| SLES for SAP 11 SP4 | openssh-askpass-gnome | 6.6p1-13.3 | SUSE-SU-2015:1695-1 |
| SLES for SAP 11 SP3 | openssh | 6.2p2-0.21.1 | SUSE-SU-2015:1581-1 |
| SLES for SAP 11 SP3 | openssh-askpass-gnome | 6.2p2-0.21.3 | SUSE-SU-2015:1581-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | openssh +6 | 6.6.1p1-22.el7 | ELSA-2015-2088 |
| Oracle Linux 7 | pam_ssh_agent_auth | 0.9.3-9.22.el7 | ELSA-2015-2088 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
Abdirisaq-ali-aynab/vulnerability-assessment ★ 0 · Nov 11, 2025
Professional cybersecurity assessment demonstrating vulnerability identification, CVSS severity scoring, MITRE ATT&CK framework application, and detailed remediation planning for OpenSSH 6.6.1p1 crit…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 12
- RHSA-2016:0466 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2015:2088 Red Hat Security Advisory: openssh security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-2710-1 openssh vulnerabilities Ubuntu Security Notices (USN) · May 29, 2026
- DLA-288-1 openssh - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1500-1 openssh - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2015:1840-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1581-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1695-1 Security update for openssh SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1544-1 Security update for openssh SUSE / openSUSE Security Updates · May 2, 2025
- ICSA-22-349-21 Siemens SCALANCE X-200RNA Switch Devices CISA ICS & IT advisories · Dec 13, 2022
- SSA-412672 SSA-412672: Multiple OpenSSL and OpenSSH Vulnerabilities in SCALANCE X-200RNA Switch Devices before V3.2.7 Siemens ProductCERT · Dec 13, 2022
- ELSA-2015-2088 Moderate: openssh security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 23, 2015
References
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- USN-2710-2 vendor-advisory
- FEDORA-2015-13469 vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05128992
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- GLSA-201512-04 vendor-advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10136
- https://security.netapp.com/advisory/ntap-20151106-0001/
- RHSA-2016:0466 vendor-advisory
- http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c.diff?r1=1.42&r2=1.43&f=h
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10697
- APPLE-SA-2015-08-13-2 vendor-advisory
- http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c
- https://kc.mcafee.com/corporate/index?page=content&id=SB10157
- 75990 vdb-entry
- 91787 vdb-entry
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952480
- SUSE-SU-2015:1581 vendor-advisory
- 92012 vdb-entry
- https://support.apple.com/kb/HT205031
- [debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update mailing-list
- [oss-security] 20150723 Re: CVE Request for OpenSSH vulnerability - authentication limits bypass mailing-list
- USN-2710-1 vendor-advisory
- FEDORA-2015-11981 vendor-advisory
- 1032988 vdb-entry
- 20150717 OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass) mailing-list
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- https://www.arista.com/en/support/advisories-notices/security-advisories/1174-security-advisory-12
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf