PT-1999-1616 · Openssh · Openssh

Published 1999-06-09 · Updated 2017-12-19 · CVE-1999-1231

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 2.0.13, possibly including 2.0.12

Description The issue allows remote attackers to determine user account names on the server by exploiting a difference in password prompts for valid and invalid user names. A valid user name can attempt to enter the correct password multiple times, while an invalid user name is only prompted for a password once.

Recommendations For versions prior to 2.0.13, including 2.0.12, update to version 2.0.13 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-1999-1231

Affected Products

Openssh

References · 3

• 🔥 http://securityfocus.com/archive/1/14758 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-1999-1231 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/2276 · Note