CVE - CVE-2016-6210

CVE-ID
CVE-2016-6210	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:91812 URL:http://www.securityfocus.com/bid/91812 CONFIRM:https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf CONFIRM:https://security.netapp.com/advisory/ntap-20190206-0001/ CONFIRM:https://www.openssh.com/txt/release-7.3 DEBIAN:DSA-3626 URL:http://www.debian.org/security/2016/dsa-3626 EXPLOIT-DB:40113 URL:https://www.exploit-db.com/exploits/40113/ EXPLOIT-DB:40136 URL:https://www.exploit-db.com/exploits/40136/ FULLDISC:20160714 opensshd - user enumeration URL:http://seclists.org/fulldisclosure/2016/Jul/51 GENTOO:GLSA-201612-18 URL:https://security.gentoo.org/glsa/201612-18 REDHAT:RHSA-2017:2029 URL:https://access.redhat.com/errata/RHSA-2017:2029 REDHAT:RHSA-2017:2563 URL:https://access.redhat.com/errata/RHSA-2017:2563 SECTRACK:1036319 URL:http://www.securitytracker.com/id/1036319
Assigning CNA
MITRE Corporation
Date Record Created
20160713	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20160713)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)