CVE-2006-5229

OpenSSH - Username Enumeration via Timing Discrepancy

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-5229. PoCs published by Marco Ivaldi.

AI-analyzed exploit summary This script exploits a timing attack vulnerability in OpenSSH (CVE-2006-5229) to determine valid usernames by measuring response time discrepancies. It uses Expect to automate SSH login attempts and analyzes the time taken for 'Permission denied' responses.

Description

OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via timing discrepancies in which responses take longer for valid usernames than invalid ones, as demonstrated by sshtime. NOTE: as of 20061014, it appears that this issue is dependent on the use of manually-set passwords that causes delays when processing /etc/shadow due to an increased number of rounds.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Marco Ivaldi · bashremotemultiple
https://www.exploit-db.com/exploits/3303

This script exploits a timing attack vulnerability in OpenSSH (CVE-2006-5229) to determine valid usernames by measuring response time discrepancies. It uses Expect to automate SSH login attempts and analyzes the time taken for 'Permission denied' responses.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: OpenSSH portable 4.1 (and earlier versions with PAM support)
No auth needed
Prerequisites: Approved target hostkey · Wordlist of usernames · Expect interpreter installed
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (9)

Core 9
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25979
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/448702/100/0/threaded
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/448025/100/0/threaded
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/448156/100/0/threaded
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/2545
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/20418
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/448108/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/32721
Various Sources x_refsource_misc
http://www.sybsecurity.com/hack-proventia-1.pdf

Scores

EPSS 0.5396
EPSS Percentile 98.9%

Details

CWE
CWE-200
Status published
Products (1)
openbsd/openssh 4.1
Published Oct 10, 2006
Tracked Since Feb 18, 2026