PT-2007-3578 · Openssh+2 · Openssh+2

Published 2007-04-25 · Updated 2024-07-08 · CVE-2007-2243

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSSH versions 4.6 and earlier

Description The issue allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY. This is because S/KEY displays a different response if the user account exists.

Recommendations For OpenSSH versions 4.6 and earlier, consider disabling ChallengeResponseAuthentication to prevent exploitation. As a temporary workaround, restrict access to S/KEY authentication until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2024-3921

ALT-PU-2024-4077

ALT-PU-2024-4467

ALT-PU-2024-9513

CVE-2007-2243

ECHO-D342-7C67-297F

Affected Products

Alt Linux

Debian

Openssh

References · 11

• https://osv.dev/vulnerability/DEBIAN-CVE-2007-2243 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-2243 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2243 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2007-2243 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33794 · Note
• https://security.netapp.com/advisory/ntap-20191107-0003 · Note
• http://securityfocus.com/bid/23601 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053906.html · Note
• http://securityreason.com/securityalert/2631 · Note
• http://osvdb.org/34600 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053951.html · Note