CVE-2016-10708

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 7.4

Description The issue is related to a denial of service caused by a NULL pointer dereference and daemon crash in OpenSSH. This can be triggered by remote attackers via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, and is related to the kex.c and packet.c files. The error occurs when handling an out-of-sequence NEWKEYS message, allowing a remote attacker to cause a denial of service.

Recommendations For OpenSSH versions prior to 7.4, update to version 7.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the sshd server to minimize the risk of exploitation.