CVE-2003-0190: Medium severity OpenBSD OpenSSH vulnerability
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable PAM support in OpenSSH (do not build or enable PAM support) to avoid immediate error messages that reveal whether a username exists.
OpenSSH-portable (OpenSSH) PAM support = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0190?
CVE-2003-0190 is classified as a medium-severity vulnerability due to the potential for remote attackers to enumerate valid usernames.
How do I fix CVE-2003-0190?
To mitigate CVE-2003-0190, upgrade to OpenSSH version 3.6.2 or later where this timing attack issue has been addressed.
What does CVE-2003-0190 affect?
CVE-2003-0190 affects OpenSSH versions up to and including 3.6.1p1, particularly when PAM support is enabled.
Who is vulnerable to CVE-2003-0190?
Organizations using vulnerable versions of OpenSSH with PAM enabled are susceptible to the enumeration of valid usernames.
What attack vector does CVE-2003-0190 utilize?
CVE-2003-0190 utilizes a timing attack to determine the existence of valid usernames on the affected OpenSSH versions.