OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via timing discrepancies in which responses take longer for valid usernames than invalid ones, as demonstrated by sshtime. NOTE: as of 20061014, it appears that this issue is dependent on the use of manually-set passwords that causes delays when processing /etc/shadow due to an increased number of rounds.

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

The remote host is running a version of OpenSSH that is vulnerable to a flaw in the way that it handles authentication requests.  Specifically, OpenSSH is alleged to vary response time based on the complexity (or availability) of the user password. An account that had no password would elicit a quicker SSH response than an account that had a defined password.  An attacker exploiting this flaw would be able to determine local accounts that had passwords.  This information would be useful in other more complex attacks.

Note: NNM has solely relied on the banner of the SSH client to perform this check. Any backported patches or workarounds such as recompiling or edited configurations are not observable through the banner.

The version of OpenSSH running on the remote host is prior to version 4.4. Such versions are affected by multiple vulnerabilities:

 - A race condition exists that may allow an unauthenticated, remote attacker to crash the service or, on portable OpenSSH, possibly execute code on the affected host. Note that successful exploitation requires that GSSAPI authentication be enabled.
 - A flaw exists that may allow an attacker to determine the validity of usernames on some platforms. Note that this issue requires that GSSAPI authentication be enabled.
 - When SSH version 1 is used, an issue can be triggered via an SSH packet that contains duplicate blocks that could result in a loss of availability for the service.
 - On Fedora Core 6 (and possibly other systems), an unspecified vulnerability in the linux_audit_record_event() function allows remote attackers to inject incorrect information into audit logs.

According to its banner, the version of OpenSSH installed on the remote host is affected by multiple vulnerabilities :

  - A race condition exists that may allow an     unauthenticated, remote attacker to crash the service     or, on portable OpenSSH, possibly execute code on the     affected host.  Note that successful exploitation     requires that GSSAPI authentication be enabled.
    
  - A flaw exists that may allow an attacker to determine     the validity of usernames on some platforms. Note that     this issue requires that GSSAPI authentication be     enabled.

  - When SSH version 1 is used, an issue can be triggered     via an SSH packet that contains duplicate blocks that     could result in a loss of availability for the service.

  - On Fedora Core 6 (and possibly other systems), an     unspecified vulnerability in the     linux_audit_record_event() function allows remote     attackers to inject incorrect information into     audit logs.

ID	Name	Product	Family	Severity
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	critical
3787	OpenSSH < 4.1.0p2 / 4.2 Timing Attack	Nessus Network Monitor	SSH	medium
3751	OpenSSH < 4.4 Multiple Vulnerabilities	Nessus Network Monitor	SSH	low
22466	OpenSSH < 4.4 Multiple Vulnerabilities	Nessus	Misc.	high

Detections

Analytics

CVE-2006-5229

critical

Tenable Plugins

critical

medium

low

high