openssh: CVE-2007-2768 and CVE-2007-2243 (determine the existence of user accounts)

Debian Bug report logs - #436571
openssh: CVE-2007-2768 and CVE-2007-2243 (determine the existence of user accounts)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <steffen.joeris@skolelinux.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: openssh: CVE-2007-2768 and CVE-2007-2243 (determine the existence of user accounts)

Date: Wed, 08 Aug 2007 19:28:53 +1000

Package: openssh
Severity: normal
Tags: security

Hi

There are two CVEs[1][2] issued for openssh. Text below:

OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM,
allows remote attackers to determine the existence of certain user
accounts, which displays a different response if the user account exists
and is configured to use one-time passwords (OTP), a similar issue to
CVE-2007-2243.

OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is
enabled, allows remote attackers to determine the existence of user
accounts by attempting to authenticate via S/KEY, which displays a
different response if the user account exists, a similar issue to
CVE-2001-1483.

Can you please check, if they occur in the current debian packages?
If you should upload a fix, please mention the CVE numbers in the
changelog.
Thanks for your efforts

Cheers
Steffen


[1]: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2243

[2]: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2768

Message #10 received at 436571@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 436571@bugs.debian.org

Cc: white@debian.org

Subject: Re: openssh: CVE-2007-2768 and CVE-2007-2243 (determine the existence of user accounts)

Date: Tue, 14 Aug 2007 18:32:40 +0200

[Message part 1 (text/plain, inline)]

Hi,
please see: http://bugs.debian.org/112279
Kind regards
Nico

-- 
Nico Golde - http://ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #17 received at 436571-done@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <steffen.joeris@skolelinux.de>

To: 436571-done@bugs.debian.org

Subject: not an issue

Date: Thu, 16 Aug 2007 21:01:33 +1000

[Message part 1 (text/plain, inline)]

Hi

This is not a security issue atm, therefore, closing this bugreport.

Cheers
Steffen

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.