openssh: timing attack leads to information disclosure [LWN.net]

Package(s):

openssh

CVE #(s):

CAN-2003-0190

Created:

May 2, 2003

Updated:

November 30, 2004

Description:

From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."

Alerts:

Ubuntu	USN-34-1	2004-11-30
OpenPKG	OpenPKG-SA-2003.035	2003-08-06
Red Hat	RHSA-2003:222-01	2003-07-29
Gentoo	200305-02	2003-05-13
Gentoo	200305-01	2002-03-05

(Log in to post comments)

openssh: timing attack leads to information disclosure

Posted Dec 2, 2004 10:28 UTC (Thu) by addw (guest, #1771) [Link]

This sort of attack has been talked about before, surely it would be easy to fix by putting something like this at program start:

start = time(0);

and then in the appropriate places:

now = time(0);
sleep((start < now) ? 0 : 1) + rand() % 4);