ssh-2.0.12 allows remote attacker to verify userids.
e159897760527f3e3ce7099c6ed5cf87f3e973ff81e295ebe8d0293cedadc7d1
Date: Wed, 9 Jun 1999 15:51:54 +0200
From: altellez@IP6SEGURIDAD.COM
To: BUGTRAQ@netspace.org
Subject: ssh advirsory
Aleph ... Sorry if it is an old bug ...
i have tested a bug in ssh-2.0.12.
any remote attacker can guess real account in the machine
Details
when a ssh client connects to the daemon it has a number ( default
three ) of attempts to guess the correct password before
disconnecting if you try to connect with a correct login, but
you only have once if you try to connect with a no correct login.
EXAMPLE
alfonso is not user ( login ) in 192.168.0.1
$ssh 192.168.0.1 -l alfonso
alfonso's password: <hit ENTER key>
Disconnected; authentication error (Authentication method disabled.).
$
altellez is user ( login ) in 192.168.0.1
$ssh 192.168.0.1 -l altellez
altellez's password: <hit ENTER key>
altellez's password:
Now the remote attacker known that altellez is a true login in
192.168.0.1
QUICK FIX
Edit the file sshd2_config (usually at /etc/ssh2), set the value
of "PasswordGuesses" to 1.
I only has tested it with ssh-2.0.12
--
Saludos.
===========================================================
Alfonso Lazaro Tellez altellez@ip6seguridad.com
Analista de seguridad
IP6Seguridad http://www.ip6seguridad.com
Tfno: +34 91-3430245 C\Alberto Alcocer 5, 1 D
Fax: +34 91-3430294 Madrid ( SPAIN )
===========================================================
-------------------------------------------------------------------------------
Date: Wed, 9 Jun 1999 15:23:23 -0500
From: Jeff Long <long@KESTREL.CC.UKANS.EDU>
To: BUGTRAQ@netspace.org
Subject: Re: ssh advirsory
altellez@IP6SEGURIDAD.COM wrote:
>
> Aleph ... Sorry if it is an old bug ...
>
>
> i have tested a bug in ssh-2.0.12.
>
> any remote attacker can guess real account in the machine
>
> Details
>
> when a ssh client connects to the daemon it has a number ( default
> three ) of attempts to guess the correct password before
> disconnecting if you try to connect with a correct login, but
> you only have once if you try to connect with a no correct login.
>
> EXAMPLE
>
> alfonso is not user ( login ) in 192.168.0.1
>
>
> $ssh 192.168.0.1 -l alfonso
> alfonso's password: <hit ENTER key>
>
> Disconnected; authentication error (Authentication method disabled.).
> $
Interesting, in my installation of 2.0.13 I don't even get one chance to
enter a password when I use a login with no account on the machine:
long@somehost[15:18:44]~ $ slogin -l jkashrj somehost
Disconnected; authentication error (No further authentication methods
available.).
long@somehost[15:19:07]~ $
Perhaps a misconfiguration on my part but I'd say that is bad behavior.
Jeff Long
-------------------------------------------------------------------------------
Date: Wed, 9 Jun 1999 16:19:56 -0300
From: cseg@WIRETECH.COM.BR
To: BUGTRAQ@netspace.org
Subject: Re: ssh advirsory
On Wed, 9 Jun 1999 altellez@IP6SEGURIDAD.COM wrote:
> Details
>
> when a ssh client connects to the daemon it has a number ( default
> three ) of attempts to guess the correct password before
> disconnecting if you try to connect with a correct login, but
> you only have once if you try to connect with a no correct login.
>
> EXAMPLE
>
> alfonso is not user ( login ) in 192.168.0.1
>
>
> $ssh 192.168.0.1 -l alfonso
> alfonso's password: <hit ENTER key>
>
> Disconnected; authentication error (Authentication method disabled.).
> $
>
> altellez is user ( login ) in 192.168.0.1
>
> $ssh 192.168.0.1 -l altellez
> altellez's password: <hit ENTER key>
> altellez's password:
>
> Now the remote attacker known that altellez is a true login in
> 192.168.0.1
>
> QUICK FIX
>
> Edit the file sshd2_config (usually at /etc/ssh2), set the value
> of "PasswordGuesses" to 1.
>
> I only has tested it with ssh-2.0.12
I just tried that error with ssh-2.0.13. It was more strange..
--- [ unexistant user `unknown' ]
local:~> ssh -lunknown 192.168.0.1
Disconnected; authentication error (No further authentication methods available.).
local:~>
--- [ existant user `me' ]
local:~> ssh -lme 192.168.0.1
me's password: [<ENTER>]
Disconnected; authentication error (Authentication method disabled.).
local:~>
--
Delete yurself, you got no chance to win.