| Package | Affected versions | Patched versions |
|---|---|---|
| openssh | = 3.6.1< 3.6.1 | 3.6.1 |
| openpkg | = 1.2= 1.3 |
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free