pam_ssh login security issue in HP-UX

[Harikrishnan L]

HI Friends,

We are scanned our hp-unix machines(11.00,11.23 and 11.31)using Nesses tool. It gives the below security risk alert. Kindly help me to close this vulnerability.


pam_ssh Login Prompt Remote Username Enumeration

Synopsis :

The remote host is running a SSH server with an information
disclosure vulnerability.

Description :

The remote host is running a SSH server that responds differently to
login attempts depending on whether or not a valid username is
given. This is likely due to a vulnerable version of pam_ssh.
A remote attacker could use this to enumerate valid usernames,
which could be used to mount further attacks.
See also :
http://bugs.gentoo.org/show_bug.cgi?id=263579

Solution :
There is no known solution at this time.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVE :
CVE-2009-1273
BID : 34333

Other references :
Secunia:34536, OSVDB:53693

Nessus ID : 38197

[Wim Rombauts]

Maybe you could tell us what version of ssh you are using (swlist -l product | grep -i -e pam -e ssh).

At my end, ssh reacts no differently for existing or nonexisting usernames.

[Kapil Jha]

can you check if you have pam_ssh.so file in the server.
If not then probably its OK to ignore.

BR,
Kapil+

[Kapil Jha]

whats your /etc/pam.conf says
it should be having 3 section
Account/Authentication/Password and Session Management

what does sshd line says there

from pam_hpsec(5) it seems that hpsec is the module which actually comes above all other authentication.

I do not see any specific libpam_ssh.so in my server i suppose its being handles by hpsec only.

BR,
Kapil+

[Harikrishnan L]

Hi fokes,

Problem solved after installed the latest version of ssh and ssl

[Mick_chair]

Hi - Where did you get it from and what version ?