CVE-2018-15473

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netapp:cn1610_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:cn1610:-:*:*:*:*:*:*:*

Configuration 6 (hide)

OR cpe:2.3:a:netapp:aff_baseboard_management_controller:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:data_ontap_edge:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:fas_baseboard_management_controller:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vsphere:*:*
cpe:2.3:a:netapp:ontap_select_deploy:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:service_processor:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vsphere:*:*
cpe:2.3:o:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:data_ontap:-:*:*:*:*:7-mode:*:*

Configuration 7 (hide)

AND
cpe:2.3:a:netapp:vasa_provider:*:*:*:*:*:*:*:*
cpe:2.3:o:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:a:netapp:storage_replication_adapter:*:*:*:*:*:vsphere:*:*
cpe:2.3:o:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*

Configuration 9 (hide)

cpe:2.3:a:oracle:sun_zfs_storage_appliance_kit:8.8.6:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:*

History

23 Feb 2023, 23:13

Type Values Removed Values Added
CPE cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:sun_zfs_storage_appliance_kit:8.8.6:*:*:*:*:*:*:*
cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
References (SECTRACK) http://www.securitytracker.com/id/1041487 - Patch, Third Party Advisory, VDB Entry (SECTRACK) http://www.securitytracker.com/id/1041487 - Broken Link, Patch, Third Party Advisory, VDB Entry
References (MISC) https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0 - Third Party Advisory (MISC) https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0 - Patch
References (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf - (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf - Patch, Third Party Advisory
References (MISC) https://www.oracle.com/security-alerts/cpujan2020.html - (MISC) https://www.oracle.com/security-alerts/cpujan2020.html - Patch, Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:2143 - (REDHAT) https://access.redhat.com/errata/RHSA-2019:2143 - Third Party Advisory
References (BID) http://www.securityfocus.com/bid/105140 - Third Party Advisory, VDB Entry (BID) http://www.securityfocus.com/bid/105140 - Broken Link, Third Party Advisory, VDB Entry
First Time Siemens scalance X204rna
Siemens scalance X204rna Firmware
Oracle
Oracle sun Zfs Storage Appliance Kit
Siemens

13 Dec 2022, 12:15

Type Values Removed Values Added
References
  • (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf -

Information

Published : 2018-08-17 19:29

Updated : 2023-12-10 12:44


NVD link : CVE-2018-15473

Mitre link : CVE-2018-15473

CVE.ORG link : CVE-2018-15473


JSON object : View

Products Affected

netapp

  • ontap_select_deploy
  • clustered_data_ontap
  • oncommand_unified_manager
  • vasa_provider
  • cloud_backup
  • steelstore_cloud_integrated_storage
  • cn1610_firmware
  • cn1610
  • service_processor
  • fas_baseboard_management_controller
  • aff_baseboard_management_controller
  • data_ontap_edge
  • data_ontap
  • storage_replication_adapter
  • virtual_storage_console

debian

  • debian_linux

siemens

  • scalance_x204rna
  • scalance_x204rna_firmware

openbsd

  • openssh

redhat

  • enterprise_linux_workstation
  • enterprise_linux_server
  • enterprise_linux_desktop

canonical

  • ubuntu_linux

oracle

  • sun_zfs_storage_appliance_kit
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')