CVE-2016-6210

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 7.3

Description An issue exists in the sshd component when SHA256 or SHA512 are used for user password hashing. When a username does not exist, the system applies BLOWFISH hashing to a static password. This creates a timing difference in response speeds compared to the processing of SHA256 or SHA512 hashes, especially when a large password (approximately 10 KB) is provided. Remote attackers can leverage this timing discrepancy to enumerate valid usernames on the system, which reduces the effort required for subsequent brute-force attacks.

Recommendations Update OpenSSH to version 7.3 or later.