OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to
    determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a
    different response if the user account exists, a similar issue to CVE-2001-1483. (CVE-2007-2243)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to     determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a     different response if the user account exists, a similar issue to CVE-2001-1483. (CVE-2007-2243)

Note that Nessus relies on the presence of the package as reported by the vendor.

When OpenSSH has S/KEY authentication enabled, it is possible to remotely determine if an account configured for S/KEY authentication exists. 

Note that Nessus has not attempted to exploit the issue but has instead only checked if OpenSSH is running on the remote host. As a result, it will not detect if the remote host has implemented a workaround.

According to the banner, OpenSSH earlier than 4.7 is running on the remote host.  Such versions contain an authentication bypass vulnerability.  In the event that OpenSSH cannot create an untrusted cookie for X, for example due to the temporary partition being full, it will use a trusted cookie instead.  This allows attackers to violate intended policy and gain privileges by causing their X client to be treated as trusted.

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

The remote host is running a version of OpenSSH prior to 4.7 is affected by an authentication bypass vulnerability. In the event that OpenSSH cannot create an untrusted cookie for X, for example due to the temporary partition being full, it will use a trusted cookie instead. This allows attackers to violate intended policy and gain privileges by causing their X client to be treated as trusted.

ID	Name	Product	Family	Type	Severity
462950	Echo: openssh: security update to 1:9.2p1-2+deb12u6	Tenable Cloud Security	Echo Local Security Checks	Local	medium
462950	Echo: openssh: security update to 1:9.2p1-2+deb12u6	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
253829	Linux Distros Unpatched Vulnerability : CVE-2007-2243	Nessus	Misc.	Local	medium
17704	OpenSSH S/KEY Authentication Account Enumeration	Nessus	Misc.	Remote	medium
44078	OpenSSH < 4.7 Trusted X11 Cookie Connection Policy Bypass	Nessus	Misc.	Remote	high
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	Remote	critical
4209	OpenSSH < 4.7 Trusted X11 Cookie Connection Policy Bypass	Nessus Network Monitor	SSH		high

Detections

Analytics

CVE-2007-2243

medium

Tenable Plugins

medium

medium

medium

medium

high

critical

high