← back
CVE-2003-0190

CVE-2003-0190

EPSS 76.8%
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.
Affected products
n/a · n/a
public PoCs found — 3
exploitdbwww.exploit-db.com/exploits/26unverifiedexploitdbwww.exploit-db.com/exploits/25unverifiedexploitdbwww.exploit-db.com/exploits/3303unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://lab.mediaservice.net/advisory/2003-01-openssh.txthttp://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004815.htmlhttp://marc.info/?l=bugtraq&m=105172058404810&w=2http://marc.info/?l=bugtraq&m=106018677302607&w=2https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A445http://www.redhat.com/support/errata/RHSA-2003-222.htmlhttp://www.redhat.com/support/errata/RHSA-2003-224.htmlhttp://www.securityfocus.com/bid/7467http://www.turbolinux.com/security/TLSA-2003-31.txt