Bug 1619063 (CVE-2018-15473) - CVE-2018-15473 openssh: User enumeration via malformed packets in authentication requests
Summary: CVE-2018-15473 openssh: User enumeration via malformed packets in authenticat...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-15473
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1619064 1619065 1619079 1666731 1690045 1850669
Blocks: 1619067
TreeView+ depends on / blocked
 
Reported: 2018-08-20 01:20 UTC by Sam Fowler
Modified: 2024-03-25 15:07 UTC (History)
41 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A user enumeration vulnerability flaw was found in OpenSSH, though version 7.7. The vulnerability occurs by not delaying bailout for an invalid authenticated user until after the packet containing the request has been fully parsed. The highest threat from this vulnerability is to data confidentiality.
Clone Of:
Environment:
Last Closed: 2019-06-10 10:36:07 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:0711 0 None None None 2019-04-09 07:15:41 UTC
Red Hat Product Errata RHSA-2019:2143 0 None None None 2019-08-06 12:20:26 UTC

Description Sam Fowler 2018-08-20 01:20:12 UTC 
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.


Upstream Patch:

https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0


Reference:

http://www.openwall.com/lists/oss-security/2018/08/15/5
Comment 1 Sam Fowler 2018-08-20 01:21:00 UTC 
Created openssh tracking bugs for this issue:

Affects: fedora-all [bug 1619064]
Comment 13 Doran Moppert 2018-10-02 02:10:41 UTC 
Statement:

Red Hat Product Security has rated this issue as having Low severity. An attacker could use this flaw to determine whether given usernames exist or not on the server, but no further information is disclosed and there is no availability or integrity impact. A future update may address this issue.
Comment 21 Doran Moppert 2018-11-26 02:33:04 UTC 
Mitigation:

Configuring your firewall to limit the origin and/or rate of incoming ssh connections (using the netfilter xt_recent module) will limit the impact of this attack, as it requires a new TCP connection for each username tested. This configuration also provides some protection against brute-force attacks on SSH passwords or keys.

See the following article for more information on limiting access to SSHD: https://access.redhat.com/solutions/8687
Comment 32 errata-xmlrpc 2019-04-09 07:15:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2019:0711 https://access.redhat.com/errata/RHSA-2019:0711
Comment 33 Joshua Megerman 2019-04-30 15:01:39 UTC 
I see that a fix was released for RHEL 6 last month, is a fix planned to be released for RHEL 7?  It seems odd to only fix the older OS release and not the current one..
Comment 34 Atul Singh 2019-05-29 11:00:02 UTC 
Yes @joshua.megerman its correct.. this vulnerability is still in RHEL 7. Red Hat has to release the update for latest OS as well
Comment 35 Poonam Nikam 2019-06-10 11:41:36 UTC 
Customer is having this bug for RHEL 7.

Will there be errata released for RHEL 7? as I can see the bug status is closed but we are still looking for RHEL 7 errata.

Please confirm.
Comment 39 errata-xmlrpc 2019-08-06 12:20:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2143 https://access.redhat.com/errata/RHSA-2019:2143
Note You need to log in before you can comment on or make changes to this bug.