NetSight
IP …
medium5.0

CVE-2009-1273

pam_ssh 1.92 and possibly other versions, as used when PAM is compiled with USE=ssh, generates different error messages depending on whether the username is va…

Impact

pam_ssh 1.92 and possibly other versions, as used when PAM is compiled with USE=ssh, generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames.

Affected products

VendorProductAffected versions
Andrew J.KortyPam Ssh
Version 1.92

Weakness classification

CWE-255

References