| Package | Affected versions | Patched versions |
|---|---|---|
| openssh | = 1.2= 1.2.1= 1.2.2= 1.2.27= 1.2.3= 1.3= 1.5= 1.5.7= 1.5.8= 2= 2.1= 2.1.1= 2.2= 2.3= 2.3.1= 2.5= 2.5.1= 2.5.2= 2.9= 2.9.9= 2.9.9p2= 2.9p1= 2.9p2= 3.0= 3.0.1= 3.0.1p1= 3.0.2= 3.0.2p1= 3.0p1= 3.1= 3.1p1= 3.2= 3.2.2= 3.2.2p1= 3.2.3p1= 3.3= 3.3p1= 3.4= 3.4p1= 3.5= 3.5p1= 3.6= 3.6.1= 3.6.1p1= 3.6.1p2 |
sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free