Detection of Error Condition Without Action

Overview Affected versions of this package are vulnerable to Detection of Error Condition Without Action due to the mishandling of error codes when the VerifyHostKeyDNS option is enabled. An attacker can impersonate a legitimate server and potentially exhaust the client's memory resources by...

IT threat evolution Q2 2024

Targeted attacks XZ backdoor: a supply chain attack in the making On March 29, a message on the Openwall oss-security mailing list announced the discovery of a backdoor in XZ, a compression utility included in many popular Linux distributions. The backdoored library is used by the OpenSSH server...

APT trends report Q2 2024

For over six years now, Kasperskys Global Research and Analysis Team GReAT has been sharing quarterly updates on advanced persistent threats APTs. These summaries draw on our threat intelligence research, offering a representative overview of what weve published and discussed in more detail in ou...

Debian Security Advisory DSA 134-1 (ssh)

The remote host is missing an update to ssh announced via advisory DSA 134-1. OpenVAS Vulnerability Test $Id: deb1341.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 134-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

CVE-2003-0190: Observable Discrepancy

OpenSSH-portable OpenSSH 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack...

PT-2003-1109 · Openssh +1 · Openssh-Portable +1

Name of the Vulnerable Software and Affected Versions: OpenSSH-portable versions 3.6.1p1 and earlier Description: The issue allows remote attackers to determine valid usernames via a timing attack when a user does not exist, due to the immediate sending of an error message with PAM support enable...