CVE-2018-15473
published 2018-08-17CVE-2018-15473: OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet…
PriorityP262medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EXPLOIT
EPSS
98.63%
99.9th percentile
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | dropbear | < dropbear 2018.76-4 (bookworm) | dropbear 2018.76-4 (bookworm) |
| debian | openssh | < openssh 1:7.7p1-4 (bookworm) | openssh 1:7.7p1-4 (bookworm) |
| dropbear_ssh_project | dropbear_ssh | <= 2018.76 | — |
| dropbear_ssh_project | dropbear_ssh | >= 0 < 2018.76-4 | 2018.76-4 |
| dropbear_ssh_project | dropbear_ssh | >= 0 < 2018.76-4 | 2018.76-4 |
| dropbear_ssh_project | dropbear_ssh | >= 0 < 2018.76-4 | 2018.76-4 |
| dropbear_ssh_project | dropbear_ssh | >= 0 < 2018.76-4 | 2018.76-4 |
| netapp | oncommand_unified_manager | >= 9.4 | — |
| netapp | storage_replication_adapter | >= 7.2 | — |
| netapp | vasa_provider | >= 7.2 | — |
| netapp | virtual_storage_console | >= 7.2 | — |
| openbsd | openssh | <= 7.7 | — |
| openbsd | openssh | >= 0 < 1:7.7p1-4 | 1:7.7p1-4 |
| openbsd | openssh | >= 0 < 1:7.7p1-4 | 1:7.7p1-4 |
| openbsd | openssh | >= 0 < 1:7.7p1-4 | 1:7.7p1-4 |
| openbsd | openssh | >= 0 < 1:7.7p1-4 | 1:7.7p1-4 |
| openbsd | openssh | >= 0 < 1:6.6p1-2ubuntu2.11 | 1:6.6p1-2ubuntu2.11 |
| openbsd | openssh | >= 0 < 1:7.2p2-4ubuntu2.6 | 1:7.2p2-4ubuntu2.6 |
| openbsd | openssh | >= 0 < 1:7.6p1-4ubuntu0.1 | 1:7.6p1-4ubuntu0.1 |
| openbsd | openssh | >= 0 < 1:7.6p1-4ubuntu0.5 | 1:7.6p1-4ubuntu0.5 |
Detection & IOCsextracted from sources · hover to see the quote
otherSSH-(.*)-OpenSSH_[^\r]+
yara
regex: '(?i)OpenSSH'
- →CVE-2018-15473 exploits a malformed SSH_MSG_USERAUTH_REQUEST packet using public key authentication; the attack works by overwriting the MSG_SERVICE_ACCEPT handler to omit a boolean field, causing OpenSSH to respond differently for valid vs. invalid usernames. ↗
- →On some OpenSSH versions, invalid users are logged while valid users are not during the enumeration attempt — monitor SSH auth logs for asymmetric logging patterns (failed auths with no corresponding valid-user log entries). ↗
- →The exploit uses paramiko to generate a throwaway RSA key and attempt auth_publickey with a malformed packet; detect rapid successive SSH public-key authentication attempts from a single source IP, especially with freshly generated ephemeral keys. ↗
- →Affected versions are OpenSSH < 7.7; fingerprint banner SSH-(.*)-OpenSSH_[^\r]+ on port 22 to identify potentially vulnerable hosts. ↗
- →Post-exploitation indicator: presence of a 'cluster-crack.pot' file in the filesystem root (/) containing cracked Linux shadow hashes, indicating john the ripper was used to crack /etc/shadow. ↗
- →Post-exploitation indicator: hidden files .payload.sh and .encrypted_csv.data downloaded from a remote GitLab repository into the working directory; monitor for wget retrieving hidden-filename payloads from gitlab.com. ↗
- →C2 exfiltration via bash TCP pseudo-device: monitor for processes writing to /dev/tcp/<IP>/<PORT> as a covert channel to send data to attacker-controlled infrastructure. ↗
- ·The username enumeration vulnerability (CVE-2018-15473) requires public key authentication to be enabled on the target SSH server; if only password authentication is permitted, the malformed-packet vector does not apply (timing attack variant may still work). ↗
- ·A similar but distinct user enumeration vulnerability exists in Dropbear SSH (through 2018.76) as CVE-2018-15599; do not conflate the two — they affect unrelated codebases. ↗
- ·The timing-attack variant of this enumeration technique may produce false positives/negatives depending on server load and network latency; results marked YMMV by the Metasploit module author. ↗
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c8qw-h3f6-fv63: OpenSSH through 7
ghsa_unreviewed·2022-05-13
CVE-2018-15473 [MEDIUM] CWE-362 GHSA-c8qw-h3f6-fv63: OpenSSH through 7
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
GHSA
GHSA-g4h3-rm2q-r287: The recv_msg_userauth_request function in svr-auth
ghsa_unreviewed·2022-05-13·CVSS 5.3
CVE-2018-15599 [MEDIUM] CWE-200 GHSA-g4h3-rm2q-r287: The recv_msg_userauth_request function in svr-auth
The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase.
OSV
openssh regression
osv·2021-08-12·CVSS 7.5
CVE-2018-15473 [HIGH] openssh regression
openssh regression
USN-3809-1 fixed vulnerabilities in OpenSSH. The update for CVE-2018-15473
was incomplete and could introduce a regression in certain environments.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Robert Swiecki discovered that OpenSSH incorrectly handled certain messages.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-10708)
It was discovered that OpenSSH incorrectly handled certain requests.
An attacker could possibly use this issue to access sensitive information.
(CVE-2018-15473)
OSV
openssh vulnerabilities
osv·2018-11-06·CVSS 7.5
CVE-2016-10708 [HIGH] openssh vulnerabilities
openssh vulnerabilities
Robert Swiecki discovered that OpenSSH incorrectly handled certain messages.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-10708)
It was discovered that OpenSSH incorrectly handled certain requests.
An attacker could possibly use this issue to access sensitive information.
(CVE-2018-15473)
OSV
CVE-2018-15599: The recv_msg_userauth_request function in svr-auth
osv·2018-08-21·CVSS 5.3
CVE-2018-15599 [MEDIUM] CVE-2018-15599: The recv_msg_userauth_request function in svr-auth
The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase.
OSV
CVE-2018-15473: OpenSSH through 7
osv·2018-08-17·CVSS 5.3
CVE-2018-15473 [MEDIUM] CVE-2018-15473: OpenSSH through 7
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
CISA ICS
Siemens SCALANCE X-200RNA Switch Devices
cisa_ics·2022-12-19
Siemens SCALANCE X-200RNA Switch Devices
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SCALANCE X-200RNA Switch Devices
Last RevisedDecember 19, 2022
Alert CodeICSA-22-349-21
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity/public exploits are available
- Vendor: Siemens
- Equipment: SCALANCE X-200RNA switch devices before V3.2.7
- Vulnerabilities: Observable Timing Discrepancy; Race Condition; Improper Restriction of Operations within the Bounds of a Memory Buffer; Improper Input Validation; NULL Pointer Dereference; Use After Free; Cryptographic Issues; Comparison of Incompatible Types; Resource Management
Ubuntu
OpenSSH regression
vendor_ubuntu·2021-08-12·CVSS 7.5
CVE-2018-15473 [HIGH] OpenSSH regression
Title: OpenSSH regression
Summary: USN-3809-1 introduced a regression in OpenSSH.
USN-3809-1 fixed vulnerabilities in OpenSSH. The update for CVE-2018-15473
was incomplete and could introduce a regression in certain environments.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Robert Swiecki discovered that OpenSSH incorrectly handled certain messages.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-10708)
It was discovered that OpenSSH incorrectly handled certain requests.
An attacker could possibly use this issue to access sensitive information.
(CVE-2018-15473)
Instructions: In general, a standard system update will make all the necessary
Palo Alto
PAN-SA-2020-0004 Informational: Third-party or open source vulnerabilities that do not affect PAN-OS
vendor_paloalto·2020-05-13·CVSS 7.5
CVE-2014-1692 [HIGH] PAN-SA-2020-0004 Informational: Third-party or open source vulnerabilities that do not affect PAN-OS
PAN-SA-2020-0004 Informational: Third-party or open source vulnerabilities that do not affect PAN-OS
Palo Alto Networks Product Security Assurance team has evaluated and determined that these third-party or open source vulnerabilities do not have a security impact on PAN-OS, or the scenarios required for successful
CVEs: CVE-2014-1692, CVE-2014-2532, CVE-2014-2653, CVE-2015-5352, CVE-2015-8325, CVE-2016-10009, CVE-2016-10010, CVE-2016-10708, CVE-2016-1908, CVE-2016-3115, CVE-2016-6515, CVE-2018-15473, CVE-2018-15919
Affected products: PAN-OS
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2018-11-06·CVSS 7.5
CVE-2016-10708 [HIGH] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
Robert Swiecki discovered that OpenSSH incorrectly handled certain messages.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-10708)
It was discovered that OpenSSH incorrectly handled certain requests.
An attacker could possibly use this issue to access sensitive information.
(CVE-2018-15473)
Instructions: In general, a standard system update will makVe all the necessary changes.
Red Hat
openssh: User enumeration via malformed packets in authentication requests
vendor_redhat·2018-08-16·CVSS 5.3
CVE-2018-15473 [MEDIUM] CWE-200 openssh: User enumeration via malformed packets in authentication requests
openssh: User enumeration via malformed packets in authentication requests
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
A user enumeration vulnerability flaw was found in OpenSSH, though version 7.7. The vulnerability occurs by not delaying bailout for an invalid authenticated user until after the packet containing the request has been fully parsed. The highest threat from this vulnerability is to data confidentiality.
Statement: Red Hat Product Security has rated this issue as having Low severity. An attacker could use this flaw to determine whether given usernames exist or
Debian
CVE-2018-15473: openssh - OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not dela...
vendor_debian·2018·CVSS 5.3
CVE-2018-15473 [MEDIUM] CVE-2018-15473: openssh - OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not dela...
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
Scope: local
bookworm: resolved (fixed in 1:7.7p1-4)
bullseye: resolved (fixed in 1:7.7p1-4)
forky: resolved (fixed in 1:7.7p1-4)
sid: resolved (fixed in 1:7.7p1-4)
trixie: resolved (fixed in 1:7.7p1-4)
Debian
CVE-2018-15599: dropbear - The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76...
vendor_debian·2018·CVSS 5.3
CVE-2018-15599 [MEDIUM] CVE-2018-15599: dropbear - The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76...
The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase.
Scope: local
bookworm: resolved (fixed in 2018.76-4)
bullseye: resolved (fixed in 2018.76-4)
forky: resolved (fixed in 2018.76-4)
sid: resolved (fixed in 2018.76-4)
trixie: resolved (fixed in 2018.76-4)
No detection rules found.
Exploit-DB
OpenSSH < 7.7 - User Enumeration (2)
exploitdb·2018-12-04·CVSS 5.3
CVE-2018-15473 [MEDIUM] OpenSSH < 7.7 - User Enumeration (2)
OpenSSH < 7.7 - User Enumeration (2)
---
#!/usr/bin/env python2
# CVE-2018-15473 SSH User Enumeration by Leap Security (@LeapSecurity) https://leapsecurity.io
# Credits: Matthew Daley, Justin Gardner, Lee David Painter
import argparse, logging, paramiko, socket, sys, os
class InvalidUsername(Exception):
pass
# malicious function to malform packet
def add_boolean(*args, **kwargs):
pass
# function that'll be overwritten to malform the packet
old_service_accept = paramiko.auth_handler.AuthHandler._client_handler_table[
paramiko.common.MSG_SERVICE_ACCEPT]
# malicious function to overwrite MSG_SERVICE_ACCEPT handler
def service_accept(*args, **kwargs):
paramiko.message.Message.add_boolean = add_boolean
return old_service_accept(*args, **kwargs)
# call when username was invalid
def inva
Exploit-DB
OpenSSH 2.3 < 7.7 - Username Enumeration
exploitdb·2018-08-21·CVSS 5.3
CVE-2018-15473 [MEDIUM] OpenSSH 2.3 < 7.7 - Username Enumeration
OpenSSH 2.3 < 7.7 - Username Enumeration
---
# Exploit: OpenSSH 7.7 - Username Enumeration
# Author: Justin Gardner
# Date: 2018-08-20
# Software: https://ftp4.usa.openbsd.org/pub/OpenBSD/OpenSSH/openssh-7.7.tar.gz
# Affected Versions: OpenSSH version < 7.7
# CVE: CVE-2018-15473
###########################################################################
# ____ _____ _____ _ _ #
# / __ \ / ____/ ____| | | | #
# | | | |_ __ ___ _ __ | (___| (___ | |__| | #
# | | | | '_ \ / _ \ '_ \ \___ \\___ \| __ | #
# | |__| | |_) | __/ | | |____) |___) | | | | #
# \____/| .__/ \___|_| |_|_____/_____/|_| |_| #
# | | Username Enumeration #
# |_| #
# #
###########################################################################
#!/usr/bin/env python
import argparse
import logging
import paramiko
import
Exploit-DB
OpenSSH 2.3 < 7.7 - Username Enumeration (PoC)
exploitdb·2018-08-16
CVE-2018-15473 OpenSSH 2.3 < 7.7 - Username Enumeration (PoC)
OpenSSH 2.3 < 7.7 - Username Enumeration (PoC)
---
#!/usr/bin/env python
# Copyright (c) 2018 Matthew Daley
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to
# deal in the Software without restriction, including without limitation the
# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
# sell copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT L
Metasploit
SSH Username Enumeration
metasploit
SSH Username Enumeration
SSH Username Enumeration
This module uses a malformed packet or timing attack to enumerate users on an OpenSSH server. The default action sends a malformed (corrupted) SSH_MSG_USERAUTH_REQUEST packet using public key authentication (must be enabled) to enumerate users. On some versions of OpenSSH under some configurations, OpenSSH will return a "permission denied" error for an invalid user faster than for a valid user, creating an opportunity for a timing attack to enumerate users. Testing note: invalid users were logged, while valid users were not. YMMV.
Nuclei
OpenSSH Service - Detect
nuclei·CVSS 5.9
CVE-2016-6210 [MEDIUM] OpenSSH Service - Detect
OpenSSH Service - Detect
OpenSSH service was detected.
Template:
id: openssh-detect
info:
name: OpenSSH Service - Detect
author: r3dg33k,daffainfo,iamthefrogy
severity: info
description: |
OpenSSH service was detected.
reference:
- http://www.openwall.com/lists/oss-security/2016/08/01/2
- http://www.openwall.com/lists/oss-security/2018/08/15/5
- http://seclists.org/fulldisclosure/2016/Jul/51
- https://nvd.nist.gov/vuln/detail/CVE-2016-6210
- https://nvd.nist.gov/vuln/detail/CVE-2018-15473
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cwe-id: CWE-200
metadata:
max-request: 1
tags: seclists,network,ssh,openssh,detect,detection,tcp,discovery
tcp:
- host:
- "{{Hostname}}"
port: 22
matchers:
- type: regex
regex:
- '(?i)OpenSSH'
extractors:
- type: regex
regex
Nuclei
MikroTik RouterOS SSH - Detect
nuclei·CVSS 5.9
CVE-2016-6210 [MEDIUM] MikroTik RouterOS SSH - Detect
MikroTik RouterOS SSH - Detect
MikroTik RouterOS SSH was detected.
Template:
id: mikrotik-ssh-detect
info:
name: MikroTik RouterOS SSH - Detect
author: staticnoise
severity: info
description: |
MikroTik RouterOS SSH was detected.
reference:
- http://www.openwall.com/lists/oss-security/2016/08/01/2
- http://www.openwall.com/lists/oss-security/2018/08/15/5
- http://seclists.org/fulldisclosure/2016/Jul/51
- https://nvd.nist.gov/vuln/detail/CVE-2016-6210
- https://nvd.nist.gov/vuln/detail/CVE-2018-15473
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cwe-id: CWE-200
metadata:
max-request: 1
shodan-query: SSH-2.0-ROSSSH
verified: true
tags: network,ssh,mikrotik,detect,detection,tcp,discovery
tcp:
- host:
- "{{Hostname}}"
port: 22
matchers:
- type: regex
regex:
-
Bugzilla
CVE-2018-15919 openssh: User enumeration via malformed packets in authentication requests
bugzilla·2018-08-28·CVSS 5.3
CVE-2018-15919 [MEDIUM] CVE-2018-15919 openssh: User enumeration via malformed packets in authentication requests
CVE-2018-15919 openssh: User enumeration via malformed packets in authentication requests
A flaw was found in OpenSSH versions from 5.9 (September 6, 2011) to the recently released 7.8 (August 24, 2018), inclusive. A remotely observable behaviour in auth-gss2.c could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. Similar to CVE-2018-15473 (it is not a timing attack)
References:
http://seclists.org/oss-sec/2018/q3/180
Discussion:
Created openssh tracking bugs for this issue:
Affects: fedora-all [bug 1623185]
---
Hi everyone, Will this cve be fixed in redhat7 ?
looking for your reply.Thanks.
---
Hi everybody
I didn't find an update for this issue to the RHEL 7.
Is there a fix?
Thanks
---
Is this vulnerability still not fixed? I
Bugzilla
CVE-2018-15599 dropbear: User enumeration via malformed packets in authentication requests
bugzilla·2018-08-28·CVSS 5.3
CVE-2018-15599 [MEDIUM] CVE-2018-15599 dropbear: User enumeration via malformed packets in authentication requests
CVE-2018-15599 dropbear: User enumeration via malformed packets in authentication requests
The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase.
References:
http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2018q3/002108.html
Upstream Patch:
https://secure.ucc.asn.au/hg/dropbear/rev/5d2d1021ca00
Discussion:
Created dropbear tracking bugs for this issue:
Affects: epel-all [bug 1623177]
Affects: fedora-all [bug 1623176]
---
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat p
Bugzilla
CVE-2018-15473 openssh: User enumeration via malformed packets in authentication requests [fedora-all]
bugzilla·2018-08-20·CVSS 5.3
CVE-2018-15473 [MEDIUM] CVE-2018-15473 openssh: User enumeration via malformed packets in authentication requests [fedora-all]
CVE-2018-15473 openssh: User enumeration via malformed packets in authentication requests [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mu
Bugzilla
CVE-2018-15473 openssh: User enumeration via malformed packets in authentication requests
bugzilla·2018-08-20·CVSS 5.3
CVE-2018-15473 [MEDIUM] CVE-2018-15473 openssh: User enumeration via malformed packets in authentication requests
CVE-2018-15473 openssh: User enumeration via malformed packets in authentication requests
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
Upstream Patch:
https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0
Reference:
http://www.openwall.com/lists/oss-security/2018/08/15/5
Discussion:
Created openssh tracking bugs for this issue:
Affects: fedora-all [bug 1619064]
---
Statement:
Red Hat Product Security has rated this issue as having Low severity. An attacker could use this flaw to determine whether given usernames exist or not on the server, b
CTF
DFIR / README
ctf_writeups·2021
DFIR / README
# Challenge Name: DFIR
## Description
Our Lubuntu server has been breached! We recieved an alert about it communicating with malicious servers and we saw a SIGNIFICANT increase in CPU usage. We SSHed in and saw that changes had been made to the / directory. We need to know how this attacker got in (so we can keep him out in the future) and what he was using our server for...
uname: "victem" (ya, we kinda jinxed ourselves with that name) pw: "correct-horse-battery-staple"
Download: https://drive.google.com/file/d/16sV8pXSrG22KL4zJ9VrpZTcZAs_N9XYw/view
## Detailed solution
Start by importing the virtualbox machine and run it
Let's SSH to the machine using the credentials in description ```victem / correct-horse-battery-staple``` get more confortable
Our machine is a ```Lubuntu
http://www.openwall.com/lists/oss-security/2018/08/15/5http://www.securityfocus.com/bid/105140http://www.securitytracker.com/id/1041487https://access.redhat.com/errata/RHSA-2019:0711https://access.redhat.com/errata/RHSA-2019:2143https://bugs.debian.org/906236https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttps://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0https://lists.debian.org/debian-lts-announce/2018/08/msg00022.htmlhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0011https://security.gentoo.org/glsa/201810-03https://security.netapp.com/advisory/ntap-20181101-0001/https://usn.ubuntu.com/3809-1/https://www.debian.org/security/2018/dsa-4280https://www.exploit-db.com/exploits/45210/https://www.exploit-db.com/exploits/45233/https://www.exploit-db.com/exploits/45939/https://www.oracle.com/security-alerts/cpujan2020.htmlhttp://www.openwall.com/lists/oss-security/2018/08/15/5http://www.securityfocus.com/bid/105140http://www.securitytracker.com/id/1041487https://access.redhat.com/errata/RHSA-2019:0711https://access.redhat.com/errata/RHSA-2019:2143https://bugs.debian.org/906236https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttps://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0https://lists.debian.org/debian-lts-announce/2018/08/msg00022.htmlhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0011https://security.gentoo.org/glsa/201810-03https://security.netapp.com/advisory/ntap-20181101-0001/https://usn.ubuntu.com/3809-1/https://www.debian.org/security/2018/dsa-4280https://www.exploit-db.com/exploits/45210/https://www.exploit-db.com/exploits/45233/https://www.exploit-db.com/exploits/45939/https://www.oracle.com/security-alerts/cpujan2020.html
2018-08-17
Published