Описание
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.
Ссылки
- Broken Link
- Broken Link
- Third Party Advisory
- Third Party Advisory
- Broken Link
- Broken Link
- Broken LinkExploitPatchThird Party AdvisoryVDB EntryVendor Advisory
- Broken Link
- Third Party Advisory
- Broken Link
- Broken Link
- Broken Link
- Third Party Advisory
- Third Party Advisory
- Broken Link
- Broken Link
- Broken LinkExploitPatchThird Party AdvisoryVDB EntryVendor Advisory
- Broken Link
- Third Party Advisory
- Broken Link
Уязвимые конфигурации
Конфигурация 1Версия до 3.6.1 (исключая)
Одно из
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:3.6.1:p1:*:*:*:*:*:*
Конфигурация 2
Одно из
cpe:2.3:a:openpkg:openpkg:1.2:*:*:*:*:*:*:*
cpe:2.3:a:openpkg:openpkg:1.3:*:*:*:*:*:*:*
Конфигурация 3Версия до 3.2.7 (исключая)
Одновременно
cpe:2.3:o:siemens:scalance_x204rna_ecc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_x204rna_ecc:-:*:*:*:*:*:*:*
Конфигурация 4Версия до 3.2.7 (исключая)
Одновременно
cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:*
EPSS
Процентиль: 100%
0.76751
Высокий
5 Medium
CVSS2
Дефекты
CWE-203
Связанные уязвимости
redhat
больше 23 лет назад
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.
debian
больше 23 лет назад
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enable ...
EPSS
Процентиль: 100%
0.76751
Высокий
5 Medium
CVSS2
Дефекты
CWE-203