Home/CVE/OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati
CVE

CVE-2018-15473

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

MEDIUM · CVSS 5.3 EPSS 0.90356
Act now
  • EPSS ≥ 0.50 - high probability of exploitation in the next 30 days
  • EPSS percentile: top 0% of all CVEs by exploitation likelihood
  • Public exploit or PoC is available
Sigma rules2 YARA rules0
⬡

Weakness Classification

CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
▤

Affected Products & Versions

21
openbsd openssh<= 7.7
debian linuxall versions
redhat enterprise linux desktopall versions
redhat enterprise linux serverall versions
redhat enterprise linux workstationall versions
canonical ubuntu linuxall versions
netapp cn1610 firmwareall versions
netapp aff baseboard management controllerall versions
⚠

Public Exploits & PoCs

8
remoteOpenSSH < 7.7 - User Enumeration (2)2018-12-04
remoteOpenSSH 2.3 < 7.7 - Username Enumerationverified
remoteOpenSSH 2.3 < 7.7 - Username Enumeration (PoC)verified
nucleiOpenSSH Service - Detectinfo
nucleiMikroTik RouterOS SSH - Detectinfo
pocwww.exploit-db.com · 45210www.exploit-db.com
pocwww.exploit-db.com · 45233www.exploit-db.com
pocwww.exploit-db.com · 45939www.exploit-db.com
◈

Sigma Hunt Rules

2
Exact rules name this CVE ID. Product rules name an affected product in their title. Related rules cover techniques used by actors who exploited this CVE. Showing the most relevant matches; the complete related set is on the full drill-down.
productmediumSuspicious OpenSSH Daemon Error
productmediumOpenSSH Server Listening On Socket
▣

Scoring & Timeline

5.3
MEDIUM · CVSS v3.1 · cve@mitre.org
View on NVD
Attack Vector
Network Adjacent Local Physical
Attack Complexity
Low High
Privileges Required
None Low High
User Interaction
None Required
Scope
Unchanged Changed
Confidentiality
None Low High
Integrity
None Low High
Availability
None Low High
Published to NVD17 Aug 2018 · 07:29 PM
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
SSVC triage · cisa-vulnrichment
Exploitation
poc
Automatable
no
Technical impact
partial
SSVC asks the questions that actually drive patch urgency: is it being exploited, can attacks be automated, and how total is the impact.
⚑

Vendor Advisories

16
suse-csafopenSUSE-SU-2024:11383-1
suse-csafopenSUSE-SU-2024:11407-1
siemens-csafSSA-412672
suse-csafopenSUSE-SU-2021:1390-1
suse-csafopenSUSE-SU-2021:1383-1
🔗

References & Sources

13
Source URLs (vendor pages, mailing lists, write-ups). Exploit/PoC links are in their own section above to avoid duplication.
http://www.openwall.com/lists/oss-security/2018/08/15/5Mailing ListPatchThird Party Advisory
http://www.securityfocus.com/bid/105140Broken LinkThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041487Broken LinkPatchThird Party AdvisoryVDB Entry
https://bugs.debian.org/906236Issue TrackingMailing ListPatchThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfPatchThird Party Advisory
https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0Patch
Intelligence Graph · click any node to traverse
CVETechnique ActorTool Family
drag to reposition · click any node to traverse · button top-right enlarges
External lookups - second-class, for what we don’t hold ourselves
NVDCVE.orgCISAVulnersExploit-DBGitHub PoCVulnCheck KEVGreyNoise
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin