OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483.

When OpenSSH has S/KEY authentication enabled, it is possible to remotely determine if an account configured for S/KEY authentication exists. 

Note that Nessus has not attempted to exploit the issue but has instead only checked if OpenSSH is running on the remote host. As a result, it will not detect if the remote host has implemented a workaround.

According to the banner, OpenSSH earlier than 4.7 is running on the remote host.  Such versions contain an authentication bypass vulnerability.  In the event that OpenSSH cannot create an untrusted cookie for X, for example due to the temporary partition being full, it will use a trusted cookie instead.  This allows attackers to violate intended policy and gain privileges by causing their X client to be treated as trusted.

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

The remote host is running a version of OpenSSH prior to 4.7 is affected by an authentication bypass vulnerability. In the event that OpenSSH cannot create an untrusted cookie for X, for example due to the temporary partition being full, it will use a trusted cookie instead. This allows attackers to violate intended policy and gain privileges by causing their X client to be treated as trusted.

ID	Name	Product	Family	Severity
17704	OpenSSH S/KEY Authentication Account Enumeration	Nessus	Misc.	medium
44078	OpenSSH < 4.7 Trusted X11 Cookie Connection Policy Bypass	Nessus	Misc.	high
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	critical
4209	OpenSSH < 4.7 Trusted X11 Cookie Connection Policy Bypass	Nessus Network Monitor	SSH	high

Detections

Analytics

CVE-2007-2243

medium

Tenable Plugins

medium

high

critical

high