OpenSSH when using OPIE (One-Time Passwords in Everything) for PAM allows remote attackers to determine the existence of certain user accounts which displays a different response if the user account exists and is configured to use one-time passwords (OTP) a similar issue to CVE-2007-2243.

🗓️ 25 Sep 2020 07:00:00Reported by MicrosoftType

OpenSSH with OPIE PAM leaks account existence via different responses for users with one time passwords.

Reporter	Title	Published	Views	Family All 116
Tenable Nessus	OpenSSH < 4.7 Trusted X11 Cookie Connection Policy Bypass	11 Sep 200700:00	–	nessus
Tenable Nessus	CBL Mariner 2.0 Security Update: openssh (CVE-2007-2768)	3 Jul 202400:00	–	nessus
Tenable Nessus	OpenSSH < 4.7 Trusted X11 Cookie Connection Policy Bypass	4 Oct 201100:00	–	nessus
Tenable Nessus	OpenSSH S/KEY Authentication Account Enumeration	18 Nov 201100:00	–	nessus
Tenable Nessus	OPIE w/ OpenSSH Account Enumeration	18 Nov 201100:00	–	nessus
Tenable Nessus	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	29 Aug 201100:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2007-2243	24 Aug 202500:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2007-2768	24 Aug 202500:00	–	nessus
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to several issues due to open source packages	19 Nov 202514:30	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to several issues due to open source packages	28 Nov 202519:13	–	ibm