Description
OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | No fix yet | — |
| Debian 13 | openssh | No fix yet | — |
| Debian 12 | openssh | No fix yet | — |
References
- 20070421 OpenSSH - System Account Enumeration if S/Key is used mailing-list
- 23601 vdb-entry
- 2631 third-party-advisory
- 34600 vdb-entry
- openssh-challenge-information-disclosure(33794) vdb-entry
- 20070424 OpenSSH - System Account Enumeration if S/Key is used mailing-list
- https://security.netapp.com/advisory/ntap-20191107-0003/