Detections
Analytics
Portable OpenSSH < 3.6.1p2 PAM Timing Side-Channel Weakness
medium Nessus Network Monitor Plugin ID 1984
Synopsis
The remote host may give an attacker information useful for future attacks.Description
The remote host is using a version of Portable OpenSSH that may allow an attacker to determine if an account exists or not by a timing analysis.Solution
Upgrade to OpenSSH-portable 3.6.1p2 or higher.Plugin Details
Severity: Medium
ID: 1984
Family: SSH
Published: 8/20/2004
Updated: 3/6/2019
Nessus ID: 11574
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Low
Base Score: 3.3
Temporal Score: 2.9
Vector: CVSS2#AV:A/AC:L/Au:N/C:P/I:N/A:N
CVSS v3
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 4.1
Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:openbsd:openssh
Reference Information
CVE: CVE-2003-0190, CVE-2003-1562