Secunia

A vulnerability has been identified in OpenSSH, which can be exploited by malicious people to enumerate valid users on a vulnerable system.

A malicious person can determine whether a user exists on a system or not by measuring the time it takes before a reply is received when connecting to the ssh service with an arbitrary user name. The problem is that OpenSSH returns an error message immidiately when the user is non-existant, while there is an approximately two second delay if the user is valid.

Successful exploitation requires that OpenSSH has been compiled with PAM support.

OpenSSH version 3.6.1p1 and prior have been reported vulnerable.

Solution
Filter traffic to the SSH service (port 22/tcp) allowing only trusted IPs to connect.

Provided and/or discovered by
Maurizio Agazzini, Solar Designer and Andrea Ghirardini.

Changelog
Further details available in Customer Area

Original Advisory
http://lab.mediaservice.net/advisory/2003-01-openssh.txt

Deep Links
Links available in Customer Area