What’s Vulnerable › Vulnerabilities

CVE-2003-0190

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 76.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2003-05-12 · updated 2026-06-16
• Weakness: CWE-203

Description

OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.

Affected products

• OpenSSH: before 3.6.1; 3.6.1-p1 — fixed in 3.6.1
• Openpkg: 1.2, 1.3
• Siemens Scalance X204Rna Ecc Firmware: before 3.2.7 — fixed in 3.2.7
• Siemens Scalance X204Rna Firmware: before 3.2.7 — fixed in 3.2.7

How to fix

Upgrade to a fixed version: OpenSSH 3.6.1; Siemens Scalance X204Rna Ecc Firmware 3.2.7; Siemens Scalance X204Rna Firmware 3.2.7. Check the vendor advisory for mitigations.

References

• http://lab.mediaservice.net/advisory/2003-01-openssh.txt
• http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004815.html
• http://marc.info/?l=bugtraq&m=105172058404810&w=2
• http://marc.info/?l=bugtraq&m=106018677302607&w=2
• http://www.redhat.com/support/errata/RHSA-2003-222.html
• http://www.redhat.com/support/errata/RHSA-2003-224.html
• http://www.securityfocus.com/bid/7467
• http://www.turbolinux.com/security/TLSA-2003-31.txt
• https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A445
• http://lab.mediaservice.net/advisory/2003-01-openssh.txt
• http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004815.html

Get alerted when CVE-2003-0190 or the next vulnerability affects your stack