User enumeration in OpenSSH - CVE-2018-15473

Vulnerability identifier: #VU14440

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-15473

CWE-ID: CWE-388

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to enumerate all accounts on the system.

The vulnerability exists due to a logical error in auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c files when processing authentication requests. A remote attacker can send a specially crafted chain of packets and monitor behavior of openssh server to determine presence of a valid username. The server will drop connection upon receiving a malformed authentication packets if the username is valid.

OpenSSH
Gentoo Linux
Amazon Linux AMI
IBM AIX
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Anolis OS
Opensuse
Ubuntu
Fedora
cflinuxfs3
Dynamic System Analysis (DSA) Preboot
Integrated Management Module II (IMM2) for BladeCenter Systems
Data Computing Appliance (DCA)
EMC Cloud Tiering Appliance
openssh (Alpine package)
openssh (Ubuntu package)
openssh (Debian package)
pam_ssh_agent_auth
openssh
openssh-askpass
openssh-cavs
openssh-clients
openssh-keycat
openssh-ldap
openssh-server
openssh-server-sysvinit
openssh-server (Ubuntu package)
Flex System Integrated Management Module (IMM2)
System x Integrated Management Module (IMM2)
Flex System Chassis Management Module (CMM)
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)

OpenSSH - update to 7.8
cflinuxfs3 - update to 0.252.0
openssh (Alpine package) - update to 7.4_p1-r2
openssh (Ubuntu package) - addressed in versions 1:6.6p1-2ubuntu2.11, 1:7.2p2-4ubuntu2.6, 1:7.6p1-4ubuntu0.1
openssh (Debian package) - addressed in versions 1:6.7p1-5+deb8u7, 1:7.4p1-10+deb9u4, 1:7.9p1-4
Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
pam_ssh_agent_auth - update to 0.10.3-2.21
Flex System Integrated Management Module (IMM2) - update to 1AOO86D-7.00
System x Integrated Management Module (IMM2) - update to 1AOO86D-7.00
Integrated Management Module II (IMM2) for BladeCenter Systems - update to 1AOO86D-7.00-bc
Flex System Chassis Management Module (CMM) - update to 2pet18a-2.5.14a
Data Computing Appliance (DCA) - update to 3.5.4.0
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.0.0.5.116
Dell EMC Unity Operating Environment (OE) - update to 5.0.0.0.5.116
openssh - update to 7.4p1-21
openssh-askpass - update to 7.4p1-21
openssh-cavs - update to 7.4p1-21
openssh-clients - update to 7.4p1-21
openssh-keycat - update to 7.4p1-21
openssh-ldap - update to 7.4p1-21
openssh-server - update to 7.4p1-21
openssh-server-sysvinit - update to 7.4p1-21
openssh-server (Ubuntu package) - update to 1:7.6p1-4ubuntu0.5
openssh - addressed in versions 7.6p1-6.fc27, 7.8p1-1.fc28
EMC Cloud Tiering Appliance - update to 12.1.0.65

• Exploit #8898 - SSH-User-Enum-Python3-CVE-2018-15473 (SSH User Enumerator in Python3, CVE-2018-15473, I updated the code of this exploit (https://www.exploit-db.com/exploits/45939) to work with python3 instead of python2.) (March 9, 2023)
• Exploit #8659 - cve-exploits (List of CVE Exploits ) (December 11, 2022)
• Exploit #6756 - CVE-2018-15473 (CVE-2018-15473 Exploit) (September 15, 2021)
• Exploit #6293 - OpenSSH 2.3 < 7.7 - Username Enumeration (June 17, 2021)
• Exploit #6046 - OpenSSH < 7.7 - User Enumeration (2) (June 17, 2021)
• Exploit #2049 - EP4-redes (CVE-2018-15473-Exploit) (March 18, 2020)
• Exploit #2155 - opensshenum (CVE-2018-15473 - Opensshenum is an user enumerator exploiting an OpenSsh bug) (March 18, 2020)
• Exploit #81 - SSH Username Enumeration (March 18, 2020)
• Exploit #203 - CVE-2018-15473-Exploit (Exploit written in Python for CVE-2018-15473 with threading and export formats) (March 18, 2020)
• Exploit #204 - CVE-2018-15473_exploit (OpenSSH < 7.7 User Enumeration CVE-2018-15473 Exploit) (March 18, 2020)

• http://seclists.org/oss-sec/2018/q3/124
• https://bugfuzz.com/stuff/ssh-check-username.py
• http://www.openssh.com/txt/release-7.8

• Information disclosure in OpenSSH
• Debian update for openssh
• Amazon Linux AMI update for openssh
• Gentoo update for OpenSSH
• Information disclosure in IBM AIX
• OpenSUSE Linux update for openssh
• OpenSUSE Linux update for openssh
• Ubuntu update for OpenSSH
• Red Hat update for openssh
• Red Hat update for openssh
• User enumeration in openssh (Alpine package)
• Cloud Foundry cflinuxfs3 update for OpenSSH
• Ubuntu update for openssh
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Multiple vulnerabilities in Dell EMC Unity Family
• Multiple vulnerabilities in Dell EMC Cloud Tiering Appliance Family
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)
• Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot
• Multiple vulnerabilities in IBM Integrated Management Module II (IMM2)
• Anolis OS update for openssh
• Fedora 28 update for openssh
• Fedora 27 update for openssh