CVE-1999-1231: Medium severity SSH Ssh2 vulnerability
ssh 2.0.12, and possibly other versions, allows valid user names to attempt to enter the correct password multiple times, but only prompts an invalid user name for a password once, which allows remote attackers to determine user account names on the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable password-based authentication in sshd_config (set PasswordAuthentication no) and require public-key authentication to eliminate password prompt-based user enumeration.
SSH (sshd) PasswordAuthentication = no - Compensating control
Restrict remote access to the SSH service to trusted IP addresses or networks (firewall, network ACLs) and/or place SSH behind a VPN or bastion/jump host so that attackers cannot directly reach the service.
- Operational
Enable and monitor SSH authentication logs for repeated or patterned failed authentication attempts indicative of username enumeration; alert and investigate suspicious activity and consider temporarily blocking offending IPs.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1231?
CVE-1999-1231 is considered a moderate severity vulnerability due to its potential to expose user account names.
How do I fix CVE-1999-1231?
To mitigate CVE-1999-1231, upgrade to a fixed version of SSH that addresses this user enumeration issue.
What versions of SSH are affected by CVE-1999-1231?
CVE-1999-1231 affects SSH versions 2.0.12 and prior, including several version 2.0 releases.
What type of vulnerability is CVE-1999-1231?
CVE-1999-1231 is an information disclosure vulnerability that allows attackers to enumerate valid usernames.
Who should be concerned about CVE-1999-1231?
System administrators using affected versions of SSH should be concerned about CVE-1999-1231 as it can compromise user account security.