CVE-2003-0190

2003-05-1204:00:00

CWE-203

mitre

web.nvd.nist.gov

123

openssh

3.6.1p1

pam support

timing attack

user enumeration

cve-2003-0190

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.3

Confidence

High

EPSS

0.049

Percentile

92.9%

JSON

OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.

Affected configurations

Nvd

Node

openbsdopensshRange<3.6.1

openbsdopensshMatch3.6.1p1

Node

openpkgopenpkgMatch1.2

openpkgopenpkgMatch1.3

Node

siemensscalance_x204rna_ecc_firmwareRange<3.2.7

AND

siemensscalance_x204rna_eccMatch-

Node

siemensscalance_x204rna_firmwareRange<3.2.7

AND

siemensscalance_x204rnaMatch-

VendorProductVersionCPE
openbsdopenssh*cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
openbsdopenssh3.6.1cpe:2.3:a:openbsd:openssh:3.6.1:p1:*:*:*:*:*:*
openpkgopenpkg1.2cpe:2.3:a:openpkg:openpkg:1.2:*:*:*:*:*:*:*
openpkgopenpkg1.3cpe:2.3:a:openpkg:openpkg:1.3:*:*:*:*:*:*:*
siemensscalance_x204rna_ecc_firmware*cpe:2.3:o:siemens:scalance_x204rna_ecc_firmware:*:*:*:*:*:*:*:*
siemensscalance_x204rna_ecc-cpe:2.3:h:siemens:scalance_x204rna_ecc:-:*:*:*:*:*:*:*
siemensscalance_x204rna_firmware*cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:*
siemensscalance_x204rna-cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openbsd	openssh	*	cpe:2.3:a:openbsd:openssh::::::::
openbsd	openssh	3.6.1	cpe:2.3:a:openbsd:openssh:3.6.1:p1::::::
openpkg	openpkg	1.2	cpe:2.3:a:openpkg:openpkg:1.2:::::::*
openpkg	openpkg	1.3	cpe:2.3:a:openpkg:openpkg:1.3:::::::*
siemens	scalance_x204rna_ecc_firmware	*	cpe:2.3:o:siemens:scalance_x204rna_ecc_firmware::::::::
siemens	scalance_x204rna_ecc	-	cpe:2.3:h:siemens:scalance_x204rna_ecc:-:::::::*
siemens	scalance_x204rna_firmware	*	cpe:2.3:o:siemens:scalance_x204rna_firmware::::::::
siemens	scalance_x204rna	-	cpe:2.3:h:siemens:scalance_x204rna:-:::::::*