Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
OpenSSH PAM启用验证延迟信息泄露漏洞
Vulnerability Description
OpenSSH是一种开放源码的SSH协议的实现，目前移植在多种系统下工作。 移植的OpenSSH版本在支持PAM的情况下存在时序攻击问题，远程攻击者可以利用这个漏洞判断用户是否存在，导致信息泄露。 根据测试，如果OpenSSH以--with-pam进行配置的情况下，由于对合法用户和非法用户响应信息的时间不同，该可以判断系统用户是否存在。在判断用户情况下，可以进一步通过猜测密码进行攻击。
CVSS Information
N/A
Vulnerability Type
N/A