74 matches found
Design/Logic Flaw
OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483...
DEBIAN-CVE-2007-2243
OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication. OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different...
CVE-2007-2243
OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483...
CVE-2007-2243
OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483...
CVE-2007-2243
OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483...
CVE-2007-2243: Improper Authentication
OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483...
OpenSSH S/Key远程信息泄露漏洞
OpenSSH是一款流行的加密安全shell应用实现。 在使用S/KEY的情况下OpenSSH存在信息泄露问题，远程攻击者可以利用漏洞获得系统帐户的敏感信息。 如果"ChallengeResponseAuthentication"设置为"Yes"默认设置，SH允许用户通过使用'ssh userid:skey at hostname'形式的S/KEY登录，一般的SSH行为如： =============================================================================== alucard $ ssh user at...
PT-2007-3578 · Openssh +2 · Openssh +2
Name of the Vulnerable Software and Affected Versions: OpenSSH versions 4.6 and earlier Description: The issue allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY. This is because S/KEY displays a different response if the user account exist...
[Full-disclosure] OpenSSH - System Account Enumeration if S/Key is used
Note to the Moderator: Sorry I send ya a Beta in the first mail : / / / / / / / / / / / / / // / / / / / / / / / // / / / // // / / / / / // ///// // // // Helith - 0815 -------------------------------------------------------------------------------- Author: Rembrandt Date: Known since somewhere ...
OpenSSH s/key Weakness
/ / / / / / / / / / / / / // / / / / / / / / / // / / / // // / / / / / // ///// // // // Helith - 0815 -------------------------------------------------------------------------------- Author : Rembrandt Date : 2007-04-21 Affected Software: openssh propably other implementations as well Affected ...
OpenSSH account enumeration
S/Key is requested only for existing user account, if S/Key authentication is used...
wu-ftpd S/KEY authentication overflow
The remote Wu-FTPd server seems to be vulnerable to a remote overflow. This version contains a remote overflow if s/key support is enabled. The skeychallenge function fails to perform bounds checking on the name variable resulting in a buffer overflow. With a specially crafted request, an attacke...
wu-ftpd S/KEY authentication overflow
The remote Wu-FTPd server seems to be vulnerable to a remote overflow. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2001-1463
The remote administration client for RhinoSoft Serv-U 3.0 sends the user password in plaintext even when S/KEY One-Time Password OTP authentication is enabled, which allows remote attackers to sniff passwords...
CVE-2001-1463: Undefined Security Weakness
The remote administration client for RhinoSoft Serv-U 3.0 sends the user password in plaintext even when S/KEY One-Time Password OTP authentication is enabled, which allows remote attackers to sniff passwords...
DEBIAN-CVE-2004-1224
Off-by-one error in the mtrcurseskeyaction function for mtr 0.55 through 0.65 allows local users to hijack raw sockets, as demonstrated using the "s" keybinding, which leaves a buffer without a NULL terminator...
WU-FTPD S/KEY Authentication ftpd.c skey_challenge Function Remote Overflow
This version of WU-FTPD contains a remote overflow if s/key support is enabled. The skeychallenge function fails to perform bounds checking on the name variable resulting in a buffer overflow. With a specially crafted request, an attacker can execute arbitrary code resulting in a loss of integrit...
RHEL 2.1 : wu-ftpd (RHSA-2004:096)
An updated wu-ftpd package that fixes two security issues is now available. The wu-ftpd package contains the Washington University FTP File Transfer Protocol server daemon. FTP is a method of transferring files between machines. Glenn Stewart discovered a flaw in wu-ftpd. When configured with...