The vulnerability of the OpenSSH cryptographic protection mechanism lies in the varying responses of the server to authentication requests. This allows attackers to discover existing user accounts.

🗓️ 29 Aug 2018 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

OpenSSH authentication responses reveal existing user accounts by timing differences.

Reporter	Title	Published	Views	Family All 270
IBM Security Bulletins	Security Bulletin: IBM Security Identity Manager Virtual Appliance is affected by multiple vulnerabilities (CVE-2019-4674, CVE-2018-15473, CVE-2019-4675)	3 Feb 202018:50	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in OpenSSH affects IBM Integrated Analytics System	6 May 202011:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by vulnerabilities in OpenSSH	7 Dec 202322:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities have been addressed in IBM Security Access Manager Appliance	30 Sep 201921:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Appliance is affected by an OpenSSH vulnerability (CVE-2018-15473)	27 Jan 202010:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Dynamic System Analysis (DSA) Preboot is affected by vulnerabilities in OpenSSH	7 Dec 202322:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Directory Suite vulnerable to information disclosure (CVE-2018-15473)	2 Nov 202019:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to OpenSSH vulnerabilty (CVE-2018-15473).	31 Mar 202022:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by an OpenSSH vulnerability	12 Nov 201915:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by vulnerability in OpenSSH (CVE-2018-15473)	11 Apr 201921:15	–	ibm

Vulners

Node

OR

openbsd opensshRange2.3–7.7

oracle sun_zfs_storage_appliance_kitMatch8.8.6

Source	Link
securitylab	www.securitylab.ru/news/495248.php
exploit-db	www.exploit-db.com/exploits/45210/
exploit-db	www.exploit-db.com/exploits/45233
exploit-db	www.exploit-db.com/exploits/45939
blog	www.blog.nviso.be/2018/08/21/openssh-user-enumeration-vulnerability-a-close-look/
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssb-439005.pdf
openwall	www.openwall.com/lists/oss-security/2018/08/15/5
securityfocus	www.securityfocus.com/bid/105140
securitytracker	www.securitytracker.com/id/1041487
bugs	www.bugs.debian.org/906236

12 Jul 2021 00:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 37.5

CVSS 27.8

EPSS0.98631

OpenSSH authentication timing user accounts server responses vulnerability