Red Hat Bugzilla – Bug 1619063
CVE-2018-15473 openssh: User enumeration via malformed packets in authentication requests
Last modified: 2018-10-25 19:16:55 EDT
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. Upstream Patch: https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0 Reference: http://www.openwall.com/lists/oss-security/2018/08/15/5
Created openssh tracking bugs for this issue: Affects: fedora-all [bug 1619064]
Statement: Red Hat Product Security has rated this issue as having Low severity. An attacker could use this flaw to determine whether given usernames exist or not on the server, but no further information is disclosed and there is no availability or integrity impact. A future update may address this issue.
Mitigation: Configuring your firewall to limit the origin and/or rate of incoming ssh connections (using the netfilter xt_recent module) will limit the impact of this attack, as it requires a new TCP connection for each username tested. This configuration also provides some protection against brute-force attacks on SSH passwords or keys.