PT-2009-3807 · Pam Ssh · Pam Ssh

Kai Krakow · Published 2009-04-08 · Updated 2009-05-13 · CVE-2009-1273

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions pam ssh version 1.92

Description The issue allows remote attackers to enumerate usernames more easily due to different error messages generated for valid and invalid usernames.

Recommendations For pam ssh version 1.92, consider modifying the error message handling to prevent disclosure of username validity as a temporary workaround until a patch is available.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2009-1273

OPENSUSE-SU-2024:10464-1

Affected Products

Pam Ssh

References · 9

• https://security-tracker.debian.org/tracker/CVE-2009-1273 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1273 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-May/msg00145.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-1273 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-May/msg00116.html · Vendor Advisory
• http://secunia.com/advisories/34536 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1273 · Vendor Advisory
• http://secunia.com/advisories/34986 · Note
• http://bugs.gentoo.org/show_bug.cgi?id=263579 · Note