CVE-2003-0190

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2003-0190
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://lab.mediaservice.net/advisory/2003-01-openssh.txt Broken Link
http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004815.html Broken Link
http://marc.info/?l=bugtraq&m=105172058404810&w=2 Third Party Advisory
http://marc.info/?l=bugtraq&m=106018677302607&w=2 Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2003-222.html Broken Link
http://www.redhat.com/support/errata/RHSA-2003-224.html Broken Link
http://www.securityfocus.com/bid/7467 Broken Link Exploit Patch Third Party Advisory VDB Entry Vendor Advisory
http://www.turbolinux.com/security/TLSA-2003-31.txt Broken Link
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A445 Broken Link
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:3.6.1:p1:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:openpkg:openpkg:1.2:*:*:*:*:*:*:*
cpe:2.3:a:openpkg:openpkg:1.3:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:siemens:scalance_x204rna_ecc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_x204rna_ecc:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:*
History

15 Feb 2024, 18:46

Type Values Removed Values Added
First Time Siemens scalance X204rna Firmware
Openpkg
Siemens scalance X204rna Ecc
Siemens
Siemens scalance X204rna Ecc Firmware
Siemens scalance X204rna
Openpkg openpkg
CPE cpe:2.3:a:openbsd:openssh:3.6.1p1:*:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:3.4p1:*:*:*:*:*:*:*		 cpe:2.3:o:siemens:scalance_x204rna_ecc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:*
cpe:2.3:a:openpkg:openpkg:1.2:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_x204rna_ecc:-:*:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:3.6.1:p1:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
cpe:2.3:a:openpkg:openpkg:1.3:*:*:*:*:*:*:*
CWE NVD-CWE-Other CWE-203
References () http://lab.mediaservice.net/advisory/2003-01-openssh.txt - () http://lab.mediaservice.net/advisory/2003-01-openssh.txt - Broken Link
References () http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004815.html - () http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004815.html - Broken Link
References () http://marc.info/?l=bugtraq&m=105172058404810&w=2 - () http://marc.info/?l=bugtraq&m=105172058404810&w=2 - Third Party Advisory
References () http://marc.info/?l=bugtraq&m=106018677302607&w=2 - () http://marc.info/?l=bugtraq&m=106018677302607&w=2 - Third Party Advisory
References () http://www.redhat.com/support/errata/RHSA-2003-222.html - () http://www.redhat.com/support/errata/RHSA-2003-222.html - Broken Link
References () http://www.redhat.com/support/errata/RHSA-2003-224.html - () http://www.redhat.com/support/errata/RHSA-2003-224.html - Broken Link
References () http://www.securityfocus.com/bid/7467 - Exploit, Patch, Vendor Advisory () http://www.securityfocus.com/bid/7467 - Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
References () http://www.turbolinux.com/security/TLSA-2003-31.txt - () http://www.turbolinux.com/security/TLSA-2003-31.txt - Broken Link
References () https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf - () https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf - Third Party Advisory
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A445 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A445 - Broken Link
Information

Published : 2003-05-12 04:00

Updated : 2024-02-15 18:46

NVD link : CVE-2003-0190

Mitre link : CVE-2003-0190

CVE.ORG link : CVE-2003-0190

JSON object : View

Products Affected

siemens

  • scalance_x204rna
  • scalance_x204rna_ecc_firmware
  • scalance_x204rna_ecc
  • scalance_x204rna_firmware

openbsd

  • openssh

openpkg

  • openpkg
CWE
CWE-203

Observable Discrepancy