OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine     the existence of certain user accounts, which displays a different response if the user account exists and     is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243. (CVE-2007-2768)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of openssh installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2007-2768 advisory.

  - OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine     the existence of certain user accounts, which displays a different response if the user account exists and     is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243. (CVE-2007-2768)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

When using OPIE for PAM and OpenSSH, it is possible for remote attackers to determine the existence of certain user accounts. 

Note that Nessus has not tried to exploit the issue, but rather only checked if OpenSSH is running on the remote host.  As a result, it does not detect if the remote host actually has OPIE for PAM installed.

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

ID	Name	Product	Family	Severity
253825	Linux Distros Unpatched Vulnerability : CVE-2007-2768	Nessus	Misc.	high
201809	CBL Mariner 2.0 Security Update: openssh (CVE-2007-2768)	Nessus	MarinerOS Local Security Checks	medium
17705	OPIE w/ OpenSSH Account Enumeration	Nessus	Misc.	medium
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	critical

Detections

Analytics

CVE-2007-2768

high

Tenable Plugins

high

medium

medium

critical