Published: 12/05/2003 Updated: 15/02/2024

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 515

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

OpenSSH-portable (OpenSSH) 3.6.1p1 and previous versions with PAM support enabled immediately sends an error message when a user does not exist, which allows remote malicious users to determine valid usernames via a timing attack.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openbsd openssh
openbsd openssh 3.6.1
openpkg openpkg 1.3
openpkg openpkg 1.2
siemens scalance_x204rna_ecc_firmware
siemens scalance_x204rna_firmware

@Mediaservicenet discovered two information leaks in the OpenSSH server When using password authentication, an attacker could test whether a login name exists by measuring the time between failed login attempts, i e the time after which the “password:” prompt appears again ...

Portable OpenSSH versions 361p-PAM / 41-SUSE and below timing attack exploit ...

/* * SSH_BRUTE - OpenSSH/PAM <= 361p1 remote users discovery tool * Copyright (c) 2003 @ Mediaservicenet Srl All rights reserved * * * Vulnerability discovered by Marco Ivaldi <raptor@mediaservicenet> * Proof of concept code by Maurizio Agazzini <inode@mediaservicenet> * * Tested against Red Hat, Mandrake, and Debian GNU/Linux ...

#!/bin/bash # # $Id: raptor_sshtime,v 11 2007/02/13 16:38:57 raptor Exp $ # # raptor_sshtime - [Open]SSH remote timing attack exploit # Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeefinfo> # # OpenSSH-portable 361p1 and earlier with PAM support enabled immediately # sends an error message when a user does not exist, which allows remo ...

#!/bin/sh # OpenSSH <= 36p1 - User Identification # Nicolas Couture - nc@stormvaultnet # # Description: # -Tells you wether or not a user exist on # a distant server running OpenSSH # # Usage: # -You NEED to have the host's public key # before executing this script # #=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-# # Fact Sheet: ...

CWE-203 http://www.securityfocus.com/bid/7467 http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004815.html http://lab.mediaservice.net/advisory/2003-01-openssh.txt http://www.redhat.com/support/errata/RHSA-2003-222.html http://www.redhat.com/support/errata/RHSA-2003-224.html http://www.turbolinux.com/security/TLSA-2003-31.txt http://marc.info/?l=bugtraq&m=105172058404810&w=2 http://marc.info/?l=bugtraq&m=106018677302607&w=2 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A445 https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf https://usn.ubuntu.com/34-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/25/https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-21

CVE-2003-0190

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Exploits

References

Vulmon Search

About

Products

Connect