CVE-2008-4109

CVE-2008-4109 is a denial-of-service vulnerability affecting specific Debian OpenSSH versions and other distributions like SUSE. It stems from an incorrect fix for a previous CVE, where non-async-signal-safe functions were used in the signal handler for login timeouts. This allows remote attackers to exhaust connection slots through multiple login attempts. The vulnerability has a CVSS score of 5.0, indicating a medium severity. It is easily exploitable over the network with low attack complexity and no authentication required, leading to a partial denial of service. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available for this specific CVE. Despite its age, it has garnered significant community discussion and media coverage, though some of the linked articles appear to be discussing a different, more recent OpenSSH vulnerability (CVE-2024-6387) rather than CVE-2008-4109.