Skip to Content.
Sympa Menu

sm-security - [SM-Security] OpenSSH/PAM timing attack

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Ladislav Hagara <hgr AT vabo.cz>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] OpenSSH/PAM timing attack
  • Date: Sat, 03 May 2003 18:40:46 +0200

Howdy security gurus !!!

According to http://lab.mediaservice.net/advisory/2003-01-openssh.txt
there is a bug in openssh.
openssh in test and stable grimoire needs to be updated.

openssh in devel grimoire is updated already (p4 change 11908).

- lace -


Example Attack Session:

root@voodoo:~# ssh [valid_user]@lab.mediaservice.net
[valid_user]@lab.mediaservice.net's password: <- arbitrary (non-null)
string
[2 secs delay]
Permission denied, please try again.

root@voodoo:~# ssh [no_such_user]@lab.mediaservice.net
[no_such_user]@lab.mediaservice.net's password: <- arbitrary (non-null)
string
[no delay]
Permission denied, please try again.








Archive powered by MHonArc 2.6.24.

Top of Page