Lucene search
Veracode Vulnerability DatabaseVERACODE:12669HistoryJan 15, 2019 - 9:20 a.m.
Information Disclosure
2019-01-1509:20:13
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
24
EPSS
0.107
Percentile
95.2%
openssh is vulnerable to information disclosure attacks. The vulnerability exists as sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
References
seclists.org/fulldisclosure/2016/Jul/51
www.debian.org/security/2016/dsa-3626
www.securityfocus.com/bid/91812
www.securitytracker.com/id/1036319
access.redhat.com/errata/RHSA-2017:2029
access.redhat.com/errata/RHSA-2017:2563
access.redhat.com/security/updates/classification/#moderate
cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
security.gentoo.org/glsa/201612-18
security.netapp.com/advisory/ntap-20190206-0001/
www.exploit-db.com/exploits/40113/
www.exploit-db.com/exploits/40136/
www.openssh.com/txt/release-7.3
Related
ibm
ibm
f5
f5
K14845276 : OpenSSH vulnerability CVE-2016-6210
2016-12-23 00:00:00
openvas
openvas
Debian: Security Advisory (DLA-578-1)
2023-03-08 00:00:00
RedHat Update for openssh RHSA-2017:2563-01
2017-09-01 00:00:00
Huawei EulerOS: Security Advisory for openssh (EulerOS-SA-2017-1189)
2020-01-23 00:00:00
centos
centos
openssh, pam_ssh_agent_auth security update
2017-08-31 18:50:28
openssh, pam_ssh_agent_auth security update
2017-08-24 01:40:16
nvd
nvd
CVE-2016-6210
2017-02-13 17:59:00
nessus
nessus
EulerOS 2.0 SP1 : openssh (EulerOS-SA-2017-1189)
2017-09-08 00:00:00
Debian DSA-3626-1 : openssh - security update
2016-07-25 00:00:00
Debian DLA-578-1 : openssh security update
2016-08-01 00:00:00
packetstorm
packetstorm
OpenSSHD 7.2p2 User Enumeration
2016-07-18 00:00:00
OpenSSHD 7.2p2 User Enumeration
2016-07-21 00:00:00
SSH Username Enumeration
2024-09-01 00:00:00
prion
prion
Design/Logic Flaw
2017-02-13 17:59:00
archlinux
archlinux
openssh: information leakage
2016-08-02 00:00:00
fedora
fedora
[SECURITY] Fedora 24 Update: openssh-7.2p2-10.fc24
2016-07-20 17:50:40
cve
cve
CVE-2016-6210
2017-02-13 17:59:00
exploitdb
exploitdb
OpenSSH 7.2p2 - Username Enumeration
2016-07-20 00:00:00
OpenSSHd 7.2p2 - Username Enumeration
2016-07-18 00:00:00
debian
debian
[SECURITY] [DSA 3626-1] openssh security update
2016-07-24 09:19:18
[SECURITY] [DLA 578-1] openssh security update
2016-07-30 21:40:46
[SECURITY] [DSA 3626-1] openssh security update
2016-07-24 09:19:18
redhat
redhat
(RHSA-2017:2563) Moderate: openssh security update
2017-08-31 13:09:34
(RHSA-2017:2029) Moderate: openssh security, bug fix, and enhancement update
2017-08-01 05:57:17
hackerone
hackerone
exploitpack
exploitpack
OpenSSHd 7.2p2 - Username Enumeration
2016-07-18 00:00:00
OpenSSH 7.2p2 - Username Enumeration
2016-07-20 00:00:00
zdt
zdt
OpenSSHd 7.2p2 - Username Enumeration (2)
2016-07-20 00:00:00
OpenSSHd 7.2p2 - Username Enumeration (1)
2016-07-18 00:00:00
alpinelinux
alpinelinux
CVE-2016-6210
2017-02-13 17:59:00
oraclelinux
oraclelinux
openssh security update
2017-08-31 00:00:00
openssh security update
2023-08-11 00:00:00
openssh security, bug fix, and enhancement update
2017-08-07 00:00:00
osv
osv
openssh - security update
2016-07-24 00:00:00
CVE-2016-6210
2017-02-13 17:59:00
openssh - security update
2016-07-30 00:00:00
ubuntucve
ubuntucve
CVE-2016-6210
2016-07-18 00:00:00
paloalto
paloalto
OpenSSH Vulnerability
2016-11-17 17:02:00
debiancve
debiancve
CVE-2016-6210
2017-02-13 17:59:00
redhatcve
redhatcve
CVE-2016-6210
2016-07-18 09:18:22
cvelist
cvelist
CVE-2016-6210
2017-02-13 00:00:00
freebsd
freebsd
openssh -- sshd -- remote valid user discovery and PAM /bin/login attack
2016-08-01 00:00:00
ubuntu
ubuntu
OpenSSH vulnerabilities
2016-08-15 00:00:00
slackware
slackware
[slackware-security] openssh
2016-08-06 21:10:35
cloudfoundry
cloudfoundry
USN-3061-1 OpenSSH vulnerability | Cloud Foundry
2016-08-25 00:00:00
symantec
symantec
SA136 : OpenSSH Vulnerabilities
2016-12-13 08:00:00
altlinux
altlinux
Security fix for the ALT Linux 7 package openssh version 6.7p1-alt1.M70P.3
2016-10-20 00:00:00
Security fix for the ALT Linux 8 package openssh version 7.2p2-alt2
2016-10-21 00:00:00
Security fix for the ALT Linux 6 package openssh version 6.7p1-alt1.M60P.3
2016-10-20 00:00:00
checkpoint_advisories
checkpoint_advisories
aix
aix
AIX OpenSSH Vulnerability
2016-09-08 14:36:37
mageia
mageia
Updated openssh packages fix security vulnerability
2016-08-31 18:32:33
metasploit
metasploit
SSH Username Enumeration
2014-11-11 20:59:41
amazon
amazon
Medium: openssh
2017-10-03 11:00:00
gentoo
gentoo
OpenSSH: Multiple vulnerabilities
2016-12-07 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2021-1938
2021-07-02 17:38:20
githubexploit
githubexploit
Exploit for Race Condition in Openbsd Openssh
2024-07-01 20:45:53
ics
ics
Siemens SCALANCE X-200RNA Switch Devices
2022-12-19 12:00:00