(Palo Alto Networks Issues Fix for Palo Alto PAN-OS) OpenSSH Lets Remote Users Determine Valid Usernames on the Target System
|
SecurityTracker Alert ID: 1037378 |
SecurityTracker URL: http://securitytracker.com/id/1037378
|
CVE Reference:
CVE-2016-6210
(Links to External Site)
|
Date: Dec 2 2016
|
Impact:
Disclosure of user information
|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
|
|
Description:
A vulnerability was reported in OpenSSH. A remote user can determine valid usernames on the target system. Palo Alto PAN-OS is affected.
A remote user can send a specially crafted request with a large password (approximately 10,000 characters) to the target ssh daemon to determine valid usernames on the target system. On systems where a valid user's password has been hashed with SHA256/SHA512, the response time will be shorter for a non-existent username than for a valid username.
Eddie Harari reported this vulnerability.
|
Impact:
A remote user can determine valid usernames on the target system.
|
Solution:
Palo Alto Networks has issued a fix (6.0.15, 6.1.15, 7.0.11, 7.1.6).
Palo Alto Networks advisory is available at:
https://securityadvisories.paloaltonetworks.com/Home/Detail/69
|
Vendor URL: securityadvisories.paloaltonetworks.com/Home/Detail/69 (Links to External Site)
|
Cause:
State error
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
|
[Original Message Not Available for Viewing]
|
|