Bug 141679 - SSH allows attacker to divine root password
SSH allows attacker to divine root password
Status: CLOSED DUPLICATE of bug 123014
Product: Fedora Legacy
Classification: Retired
Component: openssh (Show other bugs)
All Linux
low Severity medium
: ---
: ---
Assigned To: Fedora Legacy Bugs
LEGACY, 1, rh73, rh90, 2
: Security
Depends On:
  Show dependency treegraph
Reported: 2004-12-02 16:29 EST by Josh Bressers
Modified: 2007-03-27 00:25 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-06-10 21:48:12 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Josh Bressers 2004-12-02 16:29:18 EST
With openssh configured to not allow remote root login 
(file: /etc/ssh/sshd_config, PermitRootLogin no), an attempt to log 
in remotely as root with the wrong password results in a 3 second 
delay followed by:
Permission denied, please try again.

If the correct password is entered, there is no delay before 
presenting the message:
Permission denied, please try again.

An attacker could measure the time between rejections with an attack 
tool and determine the root password.

This issue also affects FC2
Comment 1 Tomas Mraz 2005-02-01 12:53:13 EST
This doesn't affect FC3 (openssh-3.9p1), only FC2.
Comment 2 Tomas Mraz 2005-04-07 03:04:47 EDT
FC2 is EOLed
Comment 3 Marc Deslauriers 2005-04-20 19:45:27 EDT
Must check if it affects older FL releases also.
Comment 4 Marc Deslauriers 2005-06-10 21:48:12 EDT
This issue was patched in the packages located in bug 123014

*** This bug has been marked as a duplicate of 123014 ***

Note You need to log in before you can comment on or make changes to this bug.