OpenSSH S/KEY Authentication Account Enumeration

medium Nessus Plugin ID 17704

Language:

Synopsis

The remote host is affected by an information disclosure vulnerability.

Description

When OpenSSH has S/KEY authentication enabled, it is possible to remotely determine if an account configured for S/KEY authentication exists.

Note that Nessus has not attempted to exploit the issue but has instead only checked if OpenSSH is running on the remote host. As a result, it will not detect if the remote host has implemented a workaround.

Solution

A patch currently does not exist for this issue. As a workaround, either set 'ChallengeResponseAuthentication' in the OpenSSH config to 'no' or use a version of OpenSSH without S/KEY support compiled in.

Plugin Details

Severity: Medium

ID: 17704

File Name: openssh_challenge_response.nasl

Version: 1.6

Type: remote

Family: Misc.

Published: 11/18/2011

Updated: 3/27/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.3

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: cpe:/a:openbsd:openssh

Required KB Items: Settings/PCI_DSS, installed_sw/OpenSSH

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 4/21/2007

Reference Information

CVE: CVE-2007-2243

BID: 23601

CWE: 287

Detections

Analytics