CVE-2016-6210 describes a user enumeration vulnerability in OpenSSH versions prior to 7.3. When SHA256 or SHA512 are configured for password hashing, attackers can leverage a timing difference in responses to a large password when the username does not exist, due to the use of BLOWFISH hashing on a static password. This medium-severity vulnerability (CVSS 5.9) has a high impact on confidentiality, allowing remote attackers to enumerate valid usernames with high attack complexity. Although not listed on CISA's KEV, exploit code is publicly available via Metasploit and ExploitDB, and it has garnered significant community discussion and media coverage, indicating a high likelihood of exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 7.2CPE matchmatch criteria | cpe:2.3:a:openbsd:openssh:*:p2:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
Feb 21, 2017openssh: User enumeration via covert timing channel
Jul 14, 2016