Gentoo: openssh Information disclosure vulnerability
Mediaservice.net has discovered a bug in OpenSSH that allows attackersto identify valid users on vulnerable systems.
Summary
- - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200305-01 - - ---------------------------------------------------------------------
- - ---------------------------------------------------------------------
Mediaservice.net has discovered a bug in OpenSSH that allows attackersto identify valid users on vulnerable systems.
Read the full advisory at
SOLUTION
It is recommended that all Gentoo Linux users who are running net-misc/openssh upgrade to openssh-3.6.1_p2 as follows:
emerge sync emerge openssh emerge clean
- - --------------------------------------------------------------------- aliz@gentoo.org - GnuPG key is available at - - ---------------------------------------------------------------------
Resolution
References
Availability
Concerns
Severity
PACKAGE : openssh
SUMMARY : timing attack leads to information disclosure
DATE : 2003-05-02 10:03 UTC
EXPLOIT : remote
VERSIONS AFFECTED : =openssh-3.6.1_p2
CVE : CAN-2003-0190
Background
