CVE-2007-2243: Medium severity OpenBSD OpenSSH vulnerability
Published Apr 25, 2007
·Updated
OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483.
Affected Software
62 affected components
OpenBSD OpenSSH=3.8
OpenBSD OpenSSH=3.8.1p1
OpenBSD OpenSSH=4.3p2
OpenBSD OpenSSH=3.2.2
OpenBSD OpenSSH=3.1
OpenBSD OpenSSH=3.0.2p1
OpenBSD OpenSSH=4.1
OpenBSD OpenSSH=3.8.1
OpenBSD OpenSSH=2.1.1
OpenBSD OpenSSH=3.7.1p2
OpenBSD OpenSSH=3.2.3p1
OpenBSD OpenSSH=3.1p1
OpenBSD OpenSSH=2.5.1
OpenBSD OpenSSH=2.9.9p2
OpenBSD OpenSSH=3.6.1p2
OpenBSD OpenSSH=3.9
OpenBSD OpenSSH=3.0
OpenBSD OpenSSH=1.2.1
OpenBSD OpenSSH=2.2
OpenBSD OpenSSH=3.2
OpenBSD OpenSSH=3.6
OpenBSD OpenSSH=1.2.3
OpenBSD OpenSSH=3.7
OpenBSD OpenSSH=4.0p1
OpenBSD OpenSSH=3.5p1
OpenBSD OpenSSH=3.0.1p1
OpenBSD OpenSSH=4.4
OpenBSD OpenSSH=3.7.1p1
OpenBSD OpenSSH=2.1
OpenBSD OpenSSH=1.2
OpenBSD OpenSSH=3.3
OpenBSD OpenSSH=3.2.2p1
OpenBSD OpenSSH=3.9.1p1
OpenBSD OpenSSH=3.0.2
OpenBSD OpenSSH=3.4p1
OpenBSD OpenSSH=3.6.1p1
OpenBSD OpenSSH=3.0.1
OpenBSD OpenSSH=2.9.9
OpenBSD OpenSSH=3.6.1
OpenBSD OpenSSH=4.1p1
OpenBSD OpenSSH=1.2.2
OpenBSD OpenSSH=4.2p1
OpenBSD OpenSSH=4.5
OpenBSD OpenSSH=2.9p1
OpenBSD OpenSSH=2.9
OpenBSD OpenSSH=3.7.1
OpenBSD OpenSSH=1.2.27
OpenBSD OpenSSH=4.2
OpenBSD OpenSSH=2.5.2
OpenBSD OpenSSH=2.3
OpenBSD OpenSSH=3.4
OpenBSD OpenSSH=4.4p1
OpenBSD OpenSSH=4.3p1
OpenBSD OpenSSH=3.5
OpenBSD OpenSSH=2.5
OpenBSD OpenSSH=3.0p1
OpenBSD OpenSSH=3.3p1
OpenBSD OpenSSH=4.3
OpenBSD OpenSSH=4.0
OpenBSD OpenSSH=3.9.1
OpenBSD OpenSSH=2.9p2
OpenBSD OpenSSH=4.6
Event History
Apr 25, 2007
CVE Published
04:19 PM
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-2243?
CVE-2007-2243 is considered a medium severity vulnerability due to the exposure of user account existence.
2
How do I fix CVE-2007-2243?
To mitigate CVE-2007-2243, disable ChallengeResponseAuthentication in the OpenSSH configuration.
3
Who is affected by CVE-2007-2243?
CVE-2007-2243 affects OpenSSH versions 4.6 and earlier.
4
What are the potential impacts of CVE-2007-2243?
Exploitation of CVE-2007-2243 can allow attackers to enumerate valid user accounts.
5
What configurations are related to CVE-2007-2243?
CVE-2007-2243 involves the configuration setting ChallengeResponseAuthentication in OpenSSH.