PT-2003-1109 · Openssh+1 · Openssh-Portable+1

Andrea Ghirardini + 3 · Published 2003-05-02 · Updated 2024-07-08 · CVE-2003-0190

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSSH-portable versions 3.6.1p1 and earlier

Description The issue allows remote attackers to determine valid usernames via a timing attack when a user does not exist, due to the immediate sending of an error message with PAM support enabled. This can lead to a violation of confidentiality. The vulnerability can be exploited remotely.

Recommendations For OpenSSH-portable versions 3.6.1p1 and earlier, consider disabling PAM support as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

ALT-PU-2024-3921

ALT-PU-2024-4077

ALT-PU-2024-4467

ALT-PU-2024-9513

BDU:2015-08184

BDU:2015-08187

BDU:2015-08190

BDU:2015-08193

BDU:2015-08196

CVE-2003-0190

Affected Products

Alt Linux

Openssh-Portable

References · 25

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssh/ssh_enumusers.rb · Exploit
• 🔥 https://exploit-db.com/exploits/25 · Exploit
• 🔥 https://exploit-db.com/exploits/26 · Exploit
• 🔥 http://securityfocus.com/bid/7467 · Exploit
• 🔥 https://exploit-db.com/exploits/3303 · Exploit
• https://bdu.fstec.ru/vul/2015-08184 · Security Note
• https://bdu.fstec.ru/vul/2015-08193 · Security Note
• https://bdu.fstec.ru/vul/2015-08196 · Security Note
• https://bdu.fstec.ru/vul/2015-08187 · Security Note
• https://bdu.fstec.ru/vul/2015-08190 · Security Note
• https://osv.dev/vulnerability/CVE-2003-0190 · Vendor Advisory
• http://turbolinux.com/security/TLSA-2003-31.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0190 · Security Note
• http://redhat.com/support/errata/RHSA-2003-224.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-222.html · Vendor Advisory