CVE-2003-0190
OpenSSH < 3.6.1 - Username Enumeration via PAM Timing Attack
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2003-0190. PoCs published by Nicolas Couture, Maurizio Agazzini.
AI-analyzed exploit summary This script exploits a timing vulnerability in OpenSSH <= 3.6.p1 to determine if a user exists on a remote server by comparing response times for valid and invalid users. It uses Expect to automate SSH login attempts and measures the delay to infer user existence.
Description
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.
Exploits (3)
This script exploits a timing vulnerability in OpenSSH <= 3.6.p1 to determine if a user exists on a remote server by comparing response times for valid and invalid users. It uses Expect to automate SSH login attempts and measures the delay to infer user existence.
This code is a proof-of-concept scanner for CVE-2003-0190, which exploits a timing discrepancy in OpenSSH/PAM to enumerate valid usernames. It measures the response time for invalid vs. valid users to determine existence.
This script exploits a timing attack vulnerability in OpenSSH (CVE-2003-0190) to determine valid usernames by measuring response time discrepancies. It uses `expect` to automate SSH login attempts and records the time taken for 'Permission denied' responses.