CVE-2016-6210

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.

The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable (CVE-2015-8325).

When SSHD tries to authenticate a non-existing user, it will pick up a fake password structure hard-coded in the SSHD source code. An attacker can measure timing information to determine if a user exists when verifying a password (CVE-2016-6210).

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string (CVE-2016-6515).

Note that CVE-2015-8325 and CVE-2016-6210 wouldn't affect most Mageia systems, as UseLogin is not enabled by default and Mageia uses Blowfish password hashes by default.

These are all security issues fixed in the openssh-7.2p2-3.1 package on the GA media of openSUSE Tumbleweed.

This update for openssh fixes the following issues:

• Prevent user enumeration through the timing of password processing (bsc#989363, CVE-2016-6210) [-prevent_timing_user_enumeration]
• Allow lowering the DH groups parameter limit in server as well as when GSSAPI key exchange is used (bsc#948902)
• limit accepted password length (prevents possible DoS) (bsc#992533, CVE-2016-6515)

Bug fixes:

• avoid complaining about unset DISPLAY variable (bsc#981654)

This update for openssh fixes the following issues:

• CVE-2016-6210: Prevent user enumeration through the timing of password processing (bsc#989363) [-prevent_timing_user_enumeration]
• Allow lowering the DH groups parameter limit in server as well as when GSSAPI key exchange is used (bsc#948902)
• CVE-2016-6515: Limiting the accepted password length to prevent possible DoS (bsc#992533)

Bug fixes:

• avoid complaining about unset DISPLAY variable (bsc#981654)

This update for OpenSSH fixes the following issues:

• Prevent user enumeration through the timing of password processing. (bsc#989363, CVE-2016-6210)
• Allow lowering the DH groups parameter limit in server as well as when GSSAPI key exchange is used. (bsc#948902)
• Sanitize input for xauth(1). (bsc#970632, CVE-2016-3115)
• Prevent X11 SECURITY circumvention when forwarding X11 connections. (bsc#962313, CVE-2016-1908)
• Disable DH parameters under 2048 bits by default and allow lowering the limit back to the RFC 4419 specified minimum through an option. (bsc#932483, bsc#948902)
• Ignore PAM environment when using login. (bsc#975865, CVE-2015-8325)
• Limit the accepted password length (prevents a possible denial of service). (bsc#992533, CVE-2016-6515)
• Relax version requires for the openssh-askpass sub-package. (bsc#962794)
• Avoid complaining about unset DISPLAY variable. (bsc#981654)
• Initialize message id to prevent connection breakups in some cases. (bsc#959096)

This update for openssh-openssl1 fixes the following issues:

Security issues fixed:

• CVE-2016-6210: Prevent user enumeration through the timing of password processing (bsc#989363)
• CVE-2016-6515: limit accepted password length (prevents possible DoS) (bsc#992533)
• CVE-2016-3115: Sanitise input for xauth(1) (bsc#970632)
• CVE-2016-1908: prevent X11 SECURITY circumvention when forwarding X11 connections (bsc#962313)
• CVE-2015-8325: ignore PAM environment when using login (bsc#975865)
• Disable DH parameters under 2048 bits by default and allow lowering the limit back to the RFC 4419 specified minimum through an option (bsc#932483, bsc#948902)
• Allow lowering the DH groups parameter limit in server as well as when GSSAPI key exchange is used (bsc#948902)

Bugs fixed:

• avoid complaining about unset DISPLAY variable (bsc#981654)
• Correctly parse GSSAPI KEX algorithms (bsc#961368)
• more verbose FIPS mode/CC related documentation in README.FIPS (bsc#965576, bsc#960414)
• fix PRNG re-seeding (bsc#960414, bsc#729190)
• Allow empty Match blocks (bsc#961494)

Eddie Harari discovered that OpenSSH incorrectly handled password hashing when authenticating non-existing users. A remote attacker could perform a timing attack and enumerate valid users. (CVE-2016-6210)

Tomas Kuthan, Andres Rojas, and Javier Nieto discovered that OpenSSH did not limit password lengths. A remote attacker could use this issue to cause OpenSSH to consume resources, leading to a denial of service. (CVE-2016-6515)