リモートホストで実行されているバージョンの SunSSH に情報漏洩脆弱性があります。SSH の仕様の設計上の欠陥により、中間攻撃者が、標準構成の SSH 保護接続から最大 32 ビットまでの平文を回収できることがあります。攻撃者はこれを悪用して、機密情報にアクセスすることがあります。

このバージョンの SunSSH はいくつかのその他の問題の影響も受けやすくなっていますが、Nessus はそれらの問題をテストしていないことに、注意してください。

リモートホストは SSHサーバーを実行しているようであり、これによって攻撃者は、存在しないログインに対する不適切なパスワードを拒否するためにリモート sshd デーモンで費やされる時間を、有効なログインに対する不適切なパスワードを拒否するために費やされる時間と比較することで、所定のログインが存在することを見つけ出せることがあります。

攻撃者は、この欠陥を使用して、リモートホストに対して力ずくの攻撃をセットアップすることがあります。

远程主机似乎正在运行 SSH 服务器，其可能允许攻击者通过比较远程 sshd 后台程序拒绝不存在的登录名的错误密码所用的时间和拒绝有效登录名的错误密码所用的时间，来确定特定登录名是否存在。

攻击者可能使用该缺陷来针对远程主机发动蛮力攻击。

遠端主機上安裝的 SunSSH 版本有資訊洩漏弱點。SSH 規格的設計瑕疵允許攔截式攻擊者在標準組態中從 SSH 受保護的連線復原多達 32 位元的純文字。攻擊者可惡意利用此弱點來存取敏感資訊。

請注意，此版本的 SunSSH 也容易發生其他多個問題，但 Nessus 並未測試這些問題。

远程主机上运行的 SunSSH 版本存在信息泄露漏洞。SSH 规范中的设计缺陷可允许中间人攻击者从标准配置的受 SSH 保护的连接中恢复多达 32 位的明文。攻击者可利用这一点获取敏感信息的访问权限。

请注意，此 SunSSH 版本也易于发生多个其他问题，但 Nessus 未对其进行测试。

Updated OpenSSH packages are now available. These updates close an information leak caused by sshd's interaction with the PAM system.

OpenSSH is a suite of network connectivity tools that can be used to establish encrypted connections between systems on a network and can provide interactive login sessions and port forwarding, among other functions.

When configured to allow password-based or challenge-response authentication, sshd (the OpenSSH server) uses PAM (Pluggable Authentication Modules) to verify the user's password. Under certain conditions, OpenSSH versions prior to 3.6.1p1 reject an invalid authentication attempt without first attempting authentication using PAM.

If PAM is configured with its default failure delay, the amount of time sshd takes to reject an invalid authentication request varies widely enough that the timing variations could be used to deduce whether or not an account with a specified name existed on the server.
This information could then be used to narrow the focus of an attack against some other system component.

These updates contain backported fixes that cause sshd to always attempt PAM authentication when performing password and challenge-response authentication for clients.

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

The remote host seems to be running an SSH server that could allow an attacker to determine the existence of a given login by comparing the time the remote sshd daemon takes to refuse a bad password for a nonexistent login compared to the time it takes to refuse a bad password for a valid login.

An attacker could use this flaw to set up a brute-force attack against the remote host.

@Mediaservice.net discovered two information leaks in the OpenSSH server. When using password authentication, an attacker could test whether a login name exists by measuring the time between failed login attempts, i. e. the time after which the 'password:' prompt appears again.

A similar issue affects systems which do not allow root logins over ssh ('PermitRootLogin no'). By measuring the time between login attempts an attacker could check whether a given root password is correct. This allowed determining weak root passwords using a brute force attack.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is using a version of Portable OpenSSH that may allow an attacker to determine if an account exists or not by a timing analysis. 

OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
55992	SunSSH < 1.1.1 / 1.3 CBC の平文での漏洩	Nessus	Misc.	2011/8/29	2020/9/21	critical
11574	PAM 付き OpenSSH の複数のタイミング攻撃弱点	Nessus	Misc.	2003/5/6	2022/4/11	critical
11574	OpenSSH w/ PAM 多种时间攻击弱点	Nessus	Misc.	2003/5/6	2022/4/11	critical
55992	SunSSH < 1.1.1 / 1.3 CBC 純文字洩漏	Nessus	Misc.	2011/8/29	2020/9/21	critical
55992	SunSSH < 1.1.1 / 1.3 CBC 明文泄露	Nessus	Misc.	2011/8/29	2020/9/21	critical
12407	RHEL 2.1 : openssh (RHSA-2003:224)	Nessus	Red Hat Local Security Checks	2004/7/6	2021/1/14	high
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	2011/8/29	2020/9/21	critical
11574	OpenSSH w/ PAM Multiple Timing Attack Weaknesses	Nessus	Misc.	2003/5/6	2022/4/11	critical
20650	Ubuntu 4.10 : openssh information leakage (USN-34-1)	Nessus	Ubuntu Local Security Checks	2006/1/15	2021/1/19	medium
1984	Portable OpenSSH < 3.6.1p2 PAM Timing Side-Channel Weakness	Nessus Network Monitor	SSH	2004/8/20	2019/3/6	medium
503094	Siemens SCALANCE X-200RNA Switch Devices Observable Timing Discrepancy (CVE-2003-0190)	Tenable OT Security	Tenable.ot	2025/3/13	2025/3/13	medium

检测

插件搜索

critical

critical

critical

critical

critical

high

critical

critical

medium

medium

medium