Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-6210Sensitive Information Exposure in Openssh

Severity
5.9MEDIUMNVD
EPSS
92.5%
top 0.27%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Timeline
PublishedFeb 13
Latest updateMay 14

Description

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages4 packages

Debianopenbsd/openssh< 1:7.2p2-6+3
Ubuntuopenbsd/openssh< 1:6.6p1-2ubuntu2.8+1
Palo Altopaloalto/pan-os

🔴Vulnerability Details

4
GHSA
GHSA-f525-65h3-3qjh: sshd in OpenSSH before 72022-05-14
OSV
CVE-2016-6210: sshd in OpenSSH before 72017-02-13
CVEList
CVE-2016-6210: sshd in OpenSSH before 72017-02-13
OSV
openssh vulnerabilities2016-08-15

💥Exploits & PoCs

4
Exploit-DB
OpenSSH 7.2p2 - Username Enumeration2016-07-20
Exploit-DB
OpenSSHd 7.2p2 - Username Enumeration2016-07-18
Nuclei
OpenSSH Service - Detect
Nuclei
MikroTik RouterOS SSH - Detect

📋Vendor Advisories

5
Microsoft
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enum2017-02-21
Palo Alto
OpenSSH Vulnerability2016-11-17
Ubuntu
OpenSSH vulnerabilities2016-08-15
Red Hat
openssh: User enumeration via covert timing channel2016-07-14
Debian
CVE-2016-6210: openssh - sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password has...2016

💬Community

3
HackerOne
Password authentication at newsletter.nextcloud.com discloses username list2020-03-01
Bugzilla
CVE-2016-6210 openssh: User enumeration via covert timing channel2016-07-18
Bugzilla
CVE-2016-6210 openssh: User enumeration via covert timing channel [fedora-all]2016-07-18
CVE-2016-6210 — Sensitive Information Exposure | cvebase