pam_ssh Existing/Non-Existing Username Enumeration Weakness

Bugtraq ID:	34333
Class:	Design Error
CVE:	CVE-2009-1273
Remote:	Yes
Local:	No
Published:	Apr 01 2009 12:00AM
Updated:	Apr 13 2015 09:51PM
Credit:	Kai Krakow
Vulnerable:	pam_ssh pam_ssh 1.92 Gentoo Linux
Not Vulnerable:

pam_ssh Existing/Non-Existing Username Enumeration Weakness

The 'pam_ssh' module is prone to a username-enumeration weakness because it displays different responses to login attempts, depending on whether or not the username exists.

Attackers may exploit this weakness to discern valid usernames. This may aid them in brute-force password cracking or other attacks.

This issue affects pam_ssh 1.92; other versions may also be affected.

pam_ssh Existing/Non-Existing Username Enumeration Weakness

Attackers can exploit this issue with readily available tools.

pam_ssh Existing/Non-Existing Username Enumeration Weakness

Solution:
Update are available. Please see the references for more information.

pam_ssh Existing/Non-Existing Username Enumeration Weakness

References:

• Bugzilla Bug 263579 ssh service exploitable if pam compiled with USE=ssh (userna (Kai Krakow)
  
• Bugzilla Bug 492153 pam_ssh: Password prompt varies for existent and non-existen (Jan Lieskovsky)
  
• pam_ssh Homepage (pam_ssh)