CVE-2018-15473

OpenSSH 7.7 - 사용자 이름 열거

방법

공격자는 손상된 패킷(예: 잘린 패킷)으로 사용자 인증을 시도할 수 있으며, 그 결과:

• 사용자가 유효하지 않으면(존재하지 않으면) userauth_pubkey()가 즉시 반환되고 서버는 공격자에게 SSH2_MSG_USERAUTH_FAILURE를 전송합니다.

• 사용자가 유효하면(존재하면) sshpkt_get_u8()가 실패하고 서버는 fatal()을 호출하고 공격자와의 연결을 종료합니다.

사용법

라이브러리 사용법은 매우 간단하며 몇 줄만으로 사용할 수 있습니다.

python <target> --port <port> --userlist <username_file> 

취약한 시스템

• Redhat Enterprise Linux 7
• Redhat Enterprise Linux 6
• Trustix Secure Enterprise Linux 2.0
• Trustix Secure Linux 2.2
• Trustix Secure Linux 2.1
• Trustix Secure Linux 2.0
• Redhat Enterprise Linux 5
• OpenSSH OpenSSH 3.4
• OpenSSH OpenSSH 3.3
• Openwall Openwall GNU/*/Linux (Owl)-current
• OpenSSH OpenSSH 2.9
• FreeBSD FreeBSD 4.6 -RELEASE
• FreeBSD FreeBSD 4.6
• FreeBSD FreeBSD 4.5 -RELEASE
• FreeBSD FreeBSD 4.5
• OpenSSH OpenSSH 2.5.2
• Caldera OpenUnix 8.0
• Caldera UnixWare 7.1.1
• Wirex Immunix OS 6.2
• OpenSSH OpenSSH 2.5.1
• NetBSD NetBSD 1.5.1
• S.u.S.E. Linux Database Server 0
• S.u.S.E. Linux Firewall on CD
• S.u.S.E. SuSE eMail Server III
• SCO Open Server 5.0.6 a
• SCO Open Server 5.0.6
• SCO Open Server 5.0.5
• SCO Open Server 5.0.4
• SCO Open Server 5.0.3
• SCO Open Server 5.0.2
• SCO Open Server 5.0.1
• SCO Open Server 5.0
• SuSE Linux 7.3
• SuSE Linux 7.2
• SuSE Linux 7.1
• SuSE SUSE Linux Enterprise Server 7
• OpenSSH OpenSSH 2.5
• OpenSSH OpenSSH 2.3
• SuSE Linux 7.0 sparc
• SuSE Linux 7.0 ppc
• SuSE Linux 7.0 i386
• SuSE Linux 7.0 alpha
• SuSE Linux 6.4 ppc
• SuSE Linux 6.4 i386
• SuSE Linux 6.4 alpha
• OpenSSH OpenSSH 2.1.1
• SuSE Linux 7.0 sparc
• SuSE Linux 7.0 ppc
• SuSE Linux 7.0 i386
• SuSE Linux 7.0 alpha
• OpenSSH OpenSSH 2.1
• OpenSSH OpenSSH 1.2.3
• Blue Coat Systems Security Gateway OS 2.1.5001 SP1
• OpenSSH OpenSSH 1.2.2
• OpenSSH OpenSSH 7.7
• OpenSSH OpenSSH 7.6
• OpenSSH OpenSSH 7.4
• OpenSSH OpenSSH 7.3
• OpenSSH OpenSSH 7.2
• OpenSSH OpenSSH 7.1
• OpenSSH OpenSSH 7.0
• OpenSSH OpenSSH 6.9
• OpenSSH OpenSSH 6.8
• OpenSSH OpenSSH 6.7
• NetBSD NetBSD 1.5.1
• S.u.S.E. Linux Database Server 0
• S.u.S.E. Linux Firewall on CD
• S.u.S.E. Linux Live-CD for Firewall
• S.u.S.E. SuSE eMail Server III
• SCO Open Server 5.0.6 a
• SCO Open Server 5.0.6
• SCO Open Server 5.0.5
• SCO Open Server 5.0.4
• SCO Open Server 5.0.3
• SCO Open Server 5.0.2
• SCO Open Server 5.0.1
• SCO Open Server 5.0
• SuSE Linux 7.3
• SuSE Linux 7.2
• SuSE Linux 7.1
• SuSE SUSE Linux Enterprise Server 7
• OpenSSH OpenSSH 6.6
• OpenSSH OpenSSH 6.5
• OpenSSH OpenSSH 6.4
• OpenSSH OpenSSH 6.3
• OpenSSH OpenSSH 6.2
• OpenSSH OpenSSH 6.1
• OpenSSH OpenSSH 6.0
• OpenSSH OpenSSH 5.8
• OpenSSH OpenSSH 5.7
• OpenSSH OpenSSH 5.6
• OpenSSH OpenSSH 5.5
• OpenSSH OpenSSH 4.5
• OpenSSH OpenSSH 1.127
• OpenSSH OpenSSH 1.126
• OpenBSD OpenSSH 6.0
• OpenBSD OpenSSH 3.0.2
• OpenBSD OpenSSH 2.5.2
• OpenBSD OpenSSH 2.3.1
• OpenBSD OpenBSD 2.8
• OpenBSD OpenBSD 2.7
• OpenBSD OpenBSD 2.6
• OpenBSD OpenSSH 2.1
• OpenBSD OpenSSH 1.2.3
• Debian Linux 2.2 sparc
• Debian Linux 2.2 powerpc
• Debian Linux 2.2 arm
• Debian Linux 2.2 alpha
• Debian Linux 2.2 68k
• Debian Linux 2.2
• OpenBSD OpenSSH 1.2
• OpenBSD OpenSSH 6.6
• OpenBSD OpenSSH 6.5
• OpenBSD OpenSSH 6.4
• OpenBSD OpenSSH 5.9
• OpenBSD OpenSSH 5.8
• OpenBSD OpenSSH 5.7
• OpenBSD OpenSSH 5.4
• OpenBSD OpenSSH 5.2
• OpenBSD OpenSSH 5.1
• OpenBSD OpenSSH 4.9
• OpenBSD OpenSSH 4.8
• OpenBSD OpenSSH 4.7
• OpenBSD OpenSSH 4.6
• OpenBSD OpenSSH 4.4
• OpenBSD OpenSSH 4.3
• OpenBSD OpenSSH 4.2
• OpenBSD OpenSSH 4.1
• OpenBSD OpenSSH 4.0