PT-2007-3578 · Openssh+2 · Openssh+2

Publicado 2007-04-25 · Atualizado 2024-07-08 · CVE-2007-2243

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSSH versions 4.6 and earlier

Description The issue allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY. This is because S/KEY displays a different response if the user account exists.

Recommendations For OpenSSH versions 4.6 and earlier, consider disabling ChallengeResponseAuthentication to prevent exploitation. As a temporary workaround, restrict access to S/KEY authentication until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

ALT-PU-2024-3921

ALT-PU-2024-4077

ALT-PU-2024-4467

ALT-PU-2024-9513

CVE-2007-2243

ECHO-D342-7C67-297F

Produtos afetados

Alt Linux

Debian

Openssh

Referências · 11

• https://exchange.xforce.ibmcloud.com/vulnerabilities/33794 · Nota
• https://security.netapp.com/advisory/ntap-20191107-0003 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-2243 · Aviso do Fabricante
• http://securityfocus.com/bid/23601 · Nota
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053906.html · Nota
• https://osv.dev/vulnerability/CVE-2007-2243 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-2243 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2007-2243 · Aviso do Fabricante
• http://securityreason.com/securityalert/2631 · Nota
• http://osvdb.org/34600 · Nota
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053951.html · Nota