github - ghsa-49wx-627v-6mcq

ghsa-49wx-627v-6mcq

Vulnerability from github

Published

2022-04-29 01:28

Modified

2022-04-29 01:28

Details

sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.

Show details on source website

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2003-1562"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2003-12-31T05:00:00Z",
    "severity": "HIGH"
  },
  "details": "sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.",
  "id": "GHSA-49wx-627v-6mcq",
  "modified": "2022-04-29T01:28:17Z",
  "published": "2022-04-29T01:28:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2003-1562"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
    },
    {
      "type": "WEB",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248747"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/320153"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/320302"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/320440"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/7482"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2003-1562 (GCVE-0-2003-1562)

Vulnerability from cvelistv5

Published

2008-08-04 10:00

Modified

2024-09-16 19:56

Severity ?

CWE

n/a

Summary

sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.

References

URL

Tags

	http://www.securityfocus.com/archive/1/320153	mailing-list
	http://www.securityfocus.com/archive/1/320302	mailing-list
	http://www.securityfocus.com/bid/7482	vdb-entry
	http://www.securityfocus.com/archive/1/320440	mailing-list
	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248747
	https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T02:35:17.602Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20030501 Re: OpenSSH/PAM timing attack allows remote users identification",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/320153"
          },
          {
            "name": "20030501 Re: OpenSSH/PAM timing attack allows remote users identification",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/320302"
          },
          {
            "name": "7482",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/7482"
          },
          {
            "name": "20030505 Re: OpenSSH/PAM timing attack allows remote users identification",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/320440"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248747"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2003-05-01T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-13T00:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20030501 Re: OpenSSH/PAM timing attack allows remote users identification",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.securityfocus.com/archive/1/320153"
        },
        {
          "name": "20030501 Re: OpenSSH/PAM timing attack allows remote users identification",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.securityfocus.com/archive/1/320302"
        },
        {
          "name": "7482",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securityfocus.com/bid/7482"
        },
        {
          "name": "20030505 Re: OpenSSH/PAM timing attack allows remote users identification",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.securityfocus.com/archive/1/320440"
        },
        {
          "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248747"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2003-1562",
    "datePublished": "2008-08-04T10:00:00Z",
    "dateReserved": "2008-08-03T00:00:00Z",
    "dateUpdated": "2024-09-16T19:56:09.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.