[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-disclosure] OpenSSH User Enumeration Time-Based Attack
- To: full-disclosure@xxxxxxxxxxxxxxxxx
- Subject: Re: [Full-disclosure] OpenSSH User Enumeration Time-Based Attack
- From: security curmudgeon <jericho@xxxxxxxxxxxxx>
- Date: Thu, 11 Jul 2013 14:24:19 -0500 (CDT)
What you describe is CVE-2006-5229. While the CVE description does not
explicitly say "long passwords", it does cover the general idea. Read the
mail list posts associated with it and it shows people testing based on
minor differences in password length. Stands to reason that 39,000
characters would apply.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-5229
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/