- CVE-2006-5051: Fix an unsafe signal hander reported by Mark Dowd. The

    signal handler was vulnerable to a race condition that could be
    exploited to perform a pre-authentication denial of service. On
    portable OpenSSH, this vulnerability could theoretically lead to
    pre-authentication remote code execution if GSSAPI authentication is
    enabled, but the likelihood of successful exploitation appears remote.

1 files changed, 1 insertions, 1 deletions

diff --git a/session.c b/session.c
index daad03929..3420db57d 100644
--- a/session.c
+++ b/session.c
@@ -2440,7 +2440,7 @@ do_cleanup(Authctxt *authctxt)
                 return;
         called = 1;
 
-        if (authctxt == NULL)
+        if (authctxt == NULL || !authctxt->authenticated)
                 return;
 #ifdef KRB5
         if (options.kerberos_ticket_cleanup &&