Asustor Security Advisory AS-2024-004: OpenSSH

Asustor, Inc. had published a security advisory concerning a resolved vulnerability in OpenSSH.

Severity: Important
Status: Ongoing

Statement
A security regression (CVE-2006-5051) was discovered in OpenSSH’s server (sshd). OpenSSH versions prior to 9.7p1 are susceptible to a vulnerability which can lead to sshd to handle some signals in an unsafe manner.

CVE-2024-6387 affected Asustor products with ADM 4.3 and ADM 4.0. Updates with OpenSSH 9.8p1 will be released as soon as possible.

• OpenSSH 9.8p1 has been updated on ADM 4.3.1.R752 to resolve the issues.

Affected products

Detail

• CVE-2024-6387
  • Severity: High
  • A security regression (CVE-2006-5051) was discovered in OpenSSH’s server (sshd). There is a race condition which can lead to sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Reference

• CVE-2024-6387
• OpenSSH Security
• OpenSSH 9.8 Release notes

Revision