NVD

Id
73331  
Name
CVE-2003-0190  
Description
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-03  
Published
2003-05-12  
Modified Date
2016-10-17  
Seq
2003-0190  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
377728 73331 CVE-2003-0190 http://lab.mediaservice.net/advisory/2003-01-openssh.txt  View
377729 73331 CVE-2003-0190 20030430 OpenSSH/PAM timing attack allows remote users identification  View
377730 73331 CVE-2003-0190 20030430 OpenSSH/PAM timing attack allows remote users identification  View
377731 73331 CVE-2003-0190 20030806 [OpenPKG-SA-2003.035] OpenPKG Security Advisory (openssh)  View
377732 73331 CVE-2003-0190 oval:org.mitre.oval:def:445  View
377733 73331 CVE-2003-0190 RHSA-2003:222  View
377734 73331 CVE-2003-0190 RHSA-2003:224  View
377735 73331 CVE-2003-0190 7467  View
377736 73331 CVE-2003-0190 TLSA-2003-31  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
63410 JVNDB-2003-000136 OpenSSH の PAM 認証におけるタイミング攻撃を受ける脆弱性 Portable 版 OpenSSH において、この設定が特定の PAM の実装と組み合わされて有効化されている場合、OpenSSH は認証に失敗する際に、存在するユーザ名と存在していないユーザ名に応じて認証結果 "Permission denied, please try again." を返すまでの時間に差が出てしまう脆弱性が存在します。 CVE-2003-0190 7018 CVE-2003-0190 73331 5 http://jvndb.jvn.jp/ja/contents/2003/JVNDB-2003-000136.html 2003-04-30 2007-04-01 View