NetSight
IP …
medium5.0Public exploit code

CVE-2003-0190

OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote atta…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.

Affected products

VendorProductAffected versions
OpenbsdOpenssh
before 3.6.1
Version 3.6.1
OpenpkgOpenpkg
Versions 1.2, 1.3
SiemensScalance X204rna Ecc Firmware
before 3.2.7
SiemensScalance X204rna Firmware
before 3.2.7

Weakness classification

CWE-203

References