CVE-2003-0190

MEDIUM 5.0CVE-2003-0190 · Published 12/05/2003 · updated 16/06/2026

Package	Affected versions	Patched versions
openssh openbsd	`= 3.6.1< 3.6.1`	`3.6.1`
openpkg openpkg	`= 1.2= 1.3`	No fix yet

Description

OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.

References

lab.mediaservice.net/advisory/2003-01-openssh.txt · Broken Link
lists.grok.org.uk/pipermail/full-disclosure/2003-April/004815.html · Broken Link
marc.info · Third Party Advisory
marc.info · Third Party Advisory
redhat.com/support/errata/RHSA-2003-222.html · Broken Link
redhat.com/support/errata/RHSA-2003-224.html · Broken Link
securityfocus.com/bid/7467 · Broken Link
turbolinux.com/security/TLSA-2003-31.txt · Broken Link
cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf · Third Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A445 · Broken Link

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free