Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

OpenSSH reveals whether a user account exists

CVE-2007-2243 · published 19 years ago
Summary

If the ChallengeResponseAuthentication setting is turned on in OpenSSH version 4.6 or older, an attacker can try to log in and see a different response depending on whether a user name is valid. This lets them confirm which accounts are present on the server, making it easier to target them later. Fix it by disabling ChallengeResponseAuthentication or upgrading to a newer OpenSSH version.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian openssh All versions
Debian:13 debian openssh All versions
Debian:14 debian openssh All versions
– openbsd openssh 1.2
1.2.1
1.2.2
1.2.3
1.2.27
2.1
2.1.1
2.2
2.3
2.5
2.5.1
2.5.2
50 more version ranges
cpe:2.3:a:openbsd:openssh:1.2:*:*:*:*:*:*:*
Original advisory text
OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays...
OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483.
References
Severity
5.0 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published25 Apr 2007
Updated29 Oct 2026
First seen28 Sep 2026
Sources
DEBIAN-CVE-2007-2243 · OSV
CVE-2007-2243 · NVD
Track software like this
Free during beta