packet.c in ssh in OpenSSH allows remote attackers to cause a denial of service (crash) by sending an invalid protocol sequence with USERAUTH_SUCCESS before NEWKEYS, which causes newkeys[mode] to be NULL.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openssh | Openbsd | 4.5 (including) | 4.5 (including) |
| Openssh | Ubuntu | dapper | * |