Description
pam_ssh 1.92 and possibly other versions, as used when PAM is compiled with USE=ssh, generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libpam-ssh | 1.92-7 | — |
| Debian 13 | libpam-ssh | 1.92-7 | — |
References
- http://bugs.gentoo.org/show_bug.cgi?id=263579
- 34986 third-party-advisory
- 34536 third-party-advisory
- FEDORA-2009-3500 vendor-advisory
- FEDORA-2009-3627 vendor-advisory