USN-34-1: OpenSSH information leakage

Releases

• Ubuntu 4.10

Details

@Mediaservice.net discovered two information leaks in the OpenSSH
server. When using password authentication, an attacker could
test whether a login name exists by measuring the time between
failed login attempts, i. e. the time after which the "password:"
prompt appears again.

A similar issue affects systems which do not allow root logins over
ssh ("PermitRootLogin no"). By measuring the time between login
attempts an attacker could check whether a given root password is
correct. This allowed determining weak root passwords using a brute
force attack.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 4.10

• openssh-server -

In general, a standard system update will make all the necessary changes.

References

• CVE-2003-0190