OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine
    the existence of certain user accounts, which displays a different response if the user account exists and
    is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243. (CVE-2007-2768)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine     the existence of certain user accounts, which displays a different response if the user account exists and     is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243. (CVE-2007-2768)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of openssh installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2007-2768 advisory.

  - OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine     the existence of certain user accounts, which displays a different response if the user account exists and     is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243. (CVE-2007-2768)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

When using OPIE for PAM and OpenSSH, it is possible for remote attackers to determine the existence of certain user accounts. 

Note that Nessus has not tried to exploit the issue, but rather only checked if OpenSSH is running on the remote host.  As a result, it does not detect if the remote host actually has OPIE for PAM installed.

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

ID	Name	Product	Family	Type	Severity
464328	Echo: openssh: security update to 1:9.2p1-2+deb12u6	Tenable Cloud Security	Echo Local Security Checks	Local	high
464328	Echo: openssh: security update to 1:9.2p1-2+deb12u6	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
253825	Linux Distros Unpatched Vulnerability : CVE-2007-2768	Nessus	Misc.	Local	high
201809	CBL Mariner 2.0 Security Update: openssh (CVE-2007-2768)	Nessus	MarinerOS Local Security Checks	Local	medium
17705	OPIE w/ OpenSSH Account Enumeration	Nessus	Misc.	Remote	medium
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	Remote	critical

Detections

Analytics

CVE-2007-2768

high

Tenable Plugins

high

high

high

medium

medium

critical