User enumeration via covert timing channel in OpenSSH - CVE-2016-6210

Vulnerability identifier: #VU255

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-6210

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to enumerate users on system.

The vulnerability exists in most systems where the Blowfish algorithm runs faster than SHA256/SHA512. A remote unauthenticated attacker can determine valid usernames by sending a specially crafted request with a large password (approximately 10,000 characters) to the target ssh daemon. On systems where a valid user's password has been hashed with SHA256/SHA512, the response time will be shorter for a non-existent username than for a valid username.

Successful exploitation of this vulnerability may result in disclosure or user logins.

OpenSSH
FlashSystem 840 9840-AE1 & 9843-AE1
Data Computing Appliance (DCA)
Amazon Linux AMI
Arch Linux
Red Hat Enterprise Linux for x86_64
Junos OS
Slackware Linux
Fedora
FlashSystem 900 9840-AE2 and 9843-AE2
Oracle VM Server for x86
IBM BladeCenter Advanced Management Module
openssh (Ubuntu package)
openssh (Debian package)
openssh (Alpine package)
selinux-policy
openssh
IBM FlashSystem V9000
IBM Storwize V7000
IBM Storwize V5000
IBM Storwize V3700
IBM Storwize V3500
IBM Spectrum Virtualize Software
IBM Spectrum Virtualize for Public Cloud

Install the latest version of OpenSSH 7.3.

openssh (Ubuntu package) - addressed in versions 1:5.9p1-5ubuntu1.10, 1:6.6p1-2ubuntu2.8, 1:7.2p2-4ubuntu2.1
openssh (Debian package) - addressed in versions 1:6.7p1-5+deb8u3, 1:7.2p2-6
openssh (Alpine package) - update to 6.7_p1-r5
Junos OS - addressed in versions 12.3X48-D55, 12.3R12-S13, 15.1F6-S12, 15.1X49-D100, 15.1R5-S4, 15.1R6-S1, 15.1R7, 16.1R3-S4, 16.1R4-S3, 16.1R5, 16.2R1-S4, 16.2R2, 17.1R1-S2, 17.1R2, 17.2R1
IBM BladeCenter Advanced Management Module - update to BPET68H-3.68H
Data Computing Appliance (DCA) - update to 3.5.2.0
selinux-policy - update to 3.13.1-158.22.fc23
openssh - addressed in versions 7.2p2-4.fc23, 7.2p2-5.fc23, 7.2p2-10.fc24
IBM FlashSystem V9000 - addressed in versions 7.7.1.9, 7.8.1.6, 8.1.1.2, 8.1.2.1
IBM Storwize V7000 - addressed in versions 7.7.1.9, 7.8.1.6, 8.1.1.2, 8.1.2.1
IBM Storwize V5000 - addressed in versions 7.7.1.9, 7.8.1.6, 8.1.1.2, 8.1.2.1
IBM Storwize V3700 - addressed in versions 7.7.1.9, 7.8.1.6, 8.1.1.2, 8.1.2.1
IBM Storwize V3500 - addressed in versions 7.7.1.9, 7.8.1.6, 8.1.1.2, 8.1.2.1
IBM Spectrum Virtualize Software - addressed in versions 7.7.1.9, 7.8.1.6, 8.1.1.2, 8.1.2.1
IBM Spectrum Virtualize for Public Cloud - addressed in versions 7.7.1.9, 7.8.1.6, 8.1.1.2, 8.1.2.1

• Exploit #8926 - CVE-2016-6210-exploit (Custom exploit written for enumerating usernames as per CVE-2016-6210) (March 20, 2023)
• Exploit #1 - SSH Username Enumeration (March 18, 2020)
• Exploit #102 - CVE-in-Ruby (Exploits written & ported to Ruby - no Metasploit) (March 18, 2020)
• Exploit #103 - CVE-2016-6210-Exploit (OpenSSH Username Enumeration - CVE-2016-6210) (March 18, 2020)
• Exploit #376 - OpenSSHd 7.2p2 - Username Enumeration (March 18, 2020)
• Exploit #377 - OpenSSHd 7.2p2 - Username Enumeration (PoC) (March 18, 2020)

• http://www.openssh.com/txt/release-7.3

• Multiple vulnerabilities in OpenSSH
• Multiple vulnerabilities in OpenSSH for Ubuntu
• Multiple vulnerabilities in OpenSSH for Debian
• Red Hat update for OpenSSH
• Ubuntu update for OpenSSH
• Arch Linux update for openssh
• Debian update for openssh
• Slackware Linux update for openssh
• Amazon Linux AMI update for openssh
• Juniper Junos OS update for OpenSSH
• User enumeration via covert timing channel in openssh (Alpine package)
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Multiple vulnerabilities in IBM FlashSystem models 840 and 900
• Multiple vulnerabilities in IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products
• Multiple vulnerabilities in IBM BladeCenter Advanced Management Module (AMM)
• Multiple vulnerabilities in Oracle VM Server for x86
• Fedora 24 update for openssh
• Fedora 23 update for openssh
• Fedora 23 update for openssh, selinux-policy