CVE-2006-5229
low · 2.6OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via timing discrepancies in which responses take longer for valid usernames than invalid ones, as demonstrated by sshtime. NOTE: as of 20061014, it appears that this issue is dependent on the use of manually-set passwords that causes delays when processing /etc/shadow due to an increased number of rounds.
2.6
CVSS
57.4%
EPSS (exploit prob.)
99th
EPSS percentile
2006-10-10
Published
AV:N/AC:H/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| openbsd | openssh | 4.1 |
| novell | suse_linux | all versions |
Check a specific version with /api/v1/cve/match.
References
- http://secunia.com/advisories/25979
- http://www.osvdb.org/32721
- http://www.securityfocus.com/archive/1/448025/100/0/threaded
- http://www.securityfocus.com/archive/1/448108/100/0/threaded
- http://www.securityfocus.com/archive/1/448156/100/0/threaded
- http://www.securityfocus.com/archive/1/448702/100/0/threaded
- http://www.securityfocus.com/bid/20418
- http://www.sybsecurity.com/hack-proventia-1.pdf
- http://www.vupen.com/english/advisories/2007/2545
- http://secunia.com/advisories/25979
- http://www.osvdb.org/32721
- http://www.securityfocus.com/archive/1/448025/100/0/threaded
- http://www.securityfocus.com/archive/1/448108/100/0/threaded
- http://www.securityfocus.com/archive/1/448156/100/0/threaded
- http://www.securityfocus.com/archive/1/448702/100/0/threaded
- http://www.securityfocus.com/bid/20418
- http://www.sybsecurity.com/hack-proventia-1.pdf
- http://www.vupen.com/english/advisories/2007/2545
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2006-5229