DSA-3626-1 openssh -- opensshID: oval:org.secpod.oval:def:602566 | Date: (C)2016-07-26 (M)2023-12-20 |
Class: PATCH | Family: unix |
Eddie Harari reported that the OpenSSH SSH daemon allows user enumeration through timing differences when trying to authenticate users. When sshd tries to authenticate a non-existing user, it will pick up a fixed fake password structure with a hash based on the Blowfish algorithm. If real users passwords are hashed using SHA256/SHA512, then a remote attacker can take advantage of this flaw by sending large passwords, receiving shorter response times from the server for non-existing users.
Product: |
openssh-server |
openssh-client |