PT-2006-5964 · Openssh · Openssh

Published 2006-10-10 · Updated 2018-10-17 · CVE-2006-5229

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSSH portable version 4.1

Description The issue allows remote attackers to determine valid usernames via timing discrepancies, where responses take longer for valid usernames than invalid ones. This is possibly dependent on the use of manually-set passwords that cause delays when processing /etc/shadow due to an increased number of rounds.

Recommendations For OpenSSH portable version 4.1, consider configuring the system to use a different password authentication method to minimize the risk of exploitation. As a temporary workaround, restrict access to the sshtime demonstration tool until a more secure configuration is implemented. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2006-5229

Affected Products

Openssh

References · 12

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssh/ssh_enumusers.rb · Exploit
• 🔥 https://exploit-db.com/exploits/3303 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5229 · Security Note
• http://secunia.com/advisories/25979 · Vendor Advisory
• http://vupen.com/english/advisories/2007/2545 · Vendor Advisory
• http://securityfocus.com/archive/1/448108/100/0/threaded · Note
• http://securityfocus.com/archive/1/448025/100/0/threaded · Note
• http://securityfocus.com/bid/20418 · Note
• http://securityfocus.com/archive/1/448702/100/0/threaded · Note
• http://securityfocus.com/archive/1/448156/100/0/threaded · Note
• http://sybsecurity.com/hack-proventia-1.pdf · Note
• http://osvdb.org/32721 · Note