A bug in OpenSSH, the most popular software for secure remote access to UNIX-based systems, could allow attackers to bypass authentication retry restrictions and execute many password guesses.
A security researcher who uses the online alias Kingcope disclosed the issueon his blog last week, but he waited until Tuesday to request a public vulnerability ID to be assigned.
By default, OpenSSH servers allow six authentication retries before closing a connection and the OpenSSH client allows three incorrect password entries, Kingcope said.
However, OpenSSH servers with keyboard-interactive authentication enabled, which is the default setting on many systems including FreeBSD ones, can be tricked to allow many authentication retries over a single connection, according to the researcher.
“With this vulnerability an attacker is able to request as many password prompts limited by the ‘login grace time’ setting, that is set to two minutes…
View original post 80 more words