Vulnerability Details : CVE-2006-5229
Public exploit exists!
OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via timing discrepancies in which responses take longer for valid usernames than invalid ones, as demonstrated by sshtime. NOTE: as of 20061014, it appears that this issue is dependent on the use of manually-set passwords that causes delays when processing /etc/shadow due to an increased number of rounds.
Vulnerability category: Information leak
Products affected by CVE-2006-5229
- cpe:2.3:a:openbsd:openssh:4.1:*:*:*:*:*:*:*When used together with: Novell » Suse Linux
Exploit prediction scoring system (EPSS) score for CVE-2006-5229
41.35%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 97 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2006-5229
-
SSH Username Enumeration
First seen: 2020-04-26auxiliary/scanner/ssh/ssh_enumusersThis module uses a malformed packet or timing attack to enumerate users on an OpenSSH server. The default action sends a malformed (corrupted) SSH_MSG_USERAUTH_REQUEST packet using public key authentication (must be enabled) to enumerate users. On
CVSS scores for CVE-2006-5229
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.6
|
LOW | AV:N/AC:H/Au:N/C:P/I:N/A:N |
4.9
|
2.9
|
NIST |
CWE ids for CVE-2006-5229
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
Vendor statements for CVE-2006-5229
-
Red Hat 2006-10-11Red Hat has been unable to reproduce this flaw and believes that the reporter was experiencing behavior specific to his environment. We will not be releasing update to address this issue.
References for CVE-2006-5229
-
http://www.securityfocus.com/archive/1/448108/100/0/threaded
-
http://www.vupen.com/english/advisories/2007/2545
Vendor Advisory
-
http://www.securityfocus.com/archive/1/448156/100/0/threaded
-
http://www.securityfocus.com/archive/1/448025/100/0/threaded
-
http://www.sybsecurity.com/hack-proventia-1.pdf
-
http://www.securityfocus.com/archive/1/448702/100/0/threaded
-
http://www.securityfocus.com/bid/20418
OpenSSH-Portable Existing Password Remote Information Disclosure Weakness
Jump to