Bug 141679

Summary: SSH allows attacker to divine root password
Product: [Retired] Fedora Legacy Reporter: Josh Bressers <bressers>
Component: opensshAssignee: Fedora Legacy Bugs <bugs>
Status: CLOSED DUPLICATE QA Contact:
Severity: medium Docs Contact:
Priority: low    
Version: fc2CC: mattdm, mjc, pza
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: LEGACY, 1, rh73, rh90, 2
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2005-06-11 01:48:12 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Josh Bressers 2004-12-02 21:29:18 UTC 
With openssh configured to not allow remote root login 
(file: /etc/ssh/sshd_config, PermitRootLogin no), an attempt to log 
in remotely as root with the wrong password results in a 3 second 
delay followed by:
Permission denied, please try again.

If the correct password is entered, there is no delay before 
presenting the message:
Permission denied, please try again.

An attacker could measure the time between rejections with an attack 
tool and determine the root password.


This issue also affects FC2
Comment 1 Tomas Mraz 2005-02-01 17:53:13 UTC 
This doesn't affect FC3 (openssh-3.9p1), only FC2.
Comment 2 Tomas Mraz 2005-04-07 07:04:47 UTC 
FC2 is EOLed
Comment 3 Marc Deslauriers 2005-04-20 23:45:27 UTC 
Must check if it affects older FL releases also.
Comment 4 Marc Deslauriers 2005-06-11 01:48:12 UTC 
This issue was patched in the packages located in bug 123014

*** This bug has been marked as a duplicate of 123014 ***