CVE

Id
8386  
CVE No.
CVE-2003-1562  
Status
Candidate  
Description
sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.  
Phase
Assigned (20080803)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
51004 8386 CVE-2003-1562 BUGTRAQ:20030501 Re: OpenSSH/PAM timing attack allows remote users identification  View
51005 8386 CVE-2003-1562 URL:http://www.securityfocus.com/archive/1/320153  View
51006 8386 CVE-2003-1562 BUGTRAQ:20030501 Re: OpenSSH/PAM timing attack allows remote users identification  View
51007 8386 CVE-2003-1562 URL:http://www.securityfocus.com/archive/1/320302  View
51008 8386 CVE-2003-1562 BUGTRAQ:20030505 Re: OpenSSH/PAM timing attack allows remote users identification  View
51009 8386 CVE-2003-1562 URL:http://www.securityfocus.com/archive/1/320440  View
51010 8386 CVE-2003-1562 CONFIRM:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248747  View
51011 8386 CVE-2003-1562 BID:7482  View

Related JVN