CVE-2016-6210
70Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 5.9epss 89%
de la publicación al arma0 días
Publicada en NVD13 feb
1ª PoC18 jul
probabilidad de explotación
89%top 1% de las CVE
explotación observada
noninguna fuente lo reporta
12 exploit(s) público(s)
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
n/a · n/aPoCs públicas encontradas — 12
exploitdbwww.exploit-db.com/exploits/40136no verificadoexploitdbwww.exploit-db.com/exploits/40113no verificadogithubgithub.com/justlce/CVE-2016-6210-Exploit★ 3githubgithub.com/serexp/poc-CVE20166210★ 2githubgithub.com/goomdan/CVE-2016-6210-exploit★ 1githubgithub.com/wabiyagi/CVE-2016-6210★ 1githubgithub.com/Alisha-chaudhary/ssh-enum★ 0githubgithub.com/KiPhuong/cve-2016-6210★ 0githubgithub.com/samh4cks/CVE-2016-6210-OpenSSH-User-Enumeration★ 0githubgithub.com/nicoleman0/CVE-2016-6210-OpenSSHd-7.2p2★ 0cve_referencewww.exploit-db.com/exploits/40136/no verificadocve_referencewww.exploit-db.com/exploits/40113/no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://access.redhat.com/errata/RHSA-2017:2029https://access.redhat.com/errata/RHSA-2017:2563https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttp://seclists.org/fulldisclosure/2016/Jul/51https://security.gentoo.org/glsa/201612-18https://security.netapp.com/advisory/ntap-20190206-0001/https://www.exploit-db.com/exploits/40113/https://www.exploit-db.com/exploits/40136/https://www.openssh.com/txt/release-7.3http://www.debian.org/security/2016/dsa-3626http://www.securityfocus.com/bid/91812http://www.securitytracker.com/id/1036319