USN-34-1: OpenSSH information leakage

30 November 2004

openssh information leakage

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 4.10

Software Description

Details

@Mediaservice.net discovered two information leaks in the OpenSSH server. When using password authentication, an attacker could test whether a login name exists by measuring the time between failed login attempts, i. e. the time after which the “password:” prompt appears again.

A similar issue affects systems which do not allow root logins over ssh (“PermitRootLogin no”). By measuring the time between login attempts an attacker could check whether a given root password is correct. This allowed determining weak root passwords using a brute force attack.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 4.10
openssh-server

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

References