SB2016072020 - User enumeration via covert timing channel in openssh (Alpine package)

Description

This security bulletin contains information about 1 security vulnerability.

1) User enumeration via covert timing channel (CVE-ID: CVE-2016-6210)

The vulnerability allows a remote attacker to enumerate users on system.

The vulnerability exists in most systems where the Blowfish algorithm runs faster than SHA256/SHA512. A remote unauthenticated attacker can determine valid usernames by sending a specially crafted request with a large password (approximately 10,000 characters) to the target ssh daemon. On systems where a valid user's password has been hashed with SHA256/SHA512, the response time will be shorter for a non-existent username than for a valid username.

Successful exploitation of this vulnerability may result in disclosure or user logins.

Remediation

Install update from vendor's website.

References

• https://git.alpinelinux.org/aports/commit/?id=a5127fa22ee9ea0631aababa5ed156c0dab2a321
• https://git.alpinelinux.org/aports/commit/?id=cf8a8f7b76eebaebfdb148506df212cd8e61a37b
• https://git.alpinelinux.org/aports/commit/?id=189784ecf63e05e7591649f8f29e1f147f88cf86
• https://git.alpinelinux.org/aports/commit/?id=685ffe83039b198cd8f173421c6be85aedcb07f6