CVE-2003-0190 json
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, whic…
published 2003-05-02 23 y ago modified 2026-06-16 4 mo ago also EUVD-2003-0186
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 76.8%
- EPSS 76.8% chance of exploitation in 30 days, percentile 99.5%
- public exploits
- 4
- Metasploit, Exploit-DB
Summary
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.
Patch / fix
- openbsd openssh 3.6.1
- siemens scalance_x204rna_ecc_firmware 3.2.7
- siemens scalance_x204rna_firmware 3.2.7
- openssh Debian 14, Debian 13, Debian 12 1:3.8.1p1-8.sarge.4
debian advisories DEBIAN-CVE-2003-0190
- securityfocus.com/bid/7467 advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2003-0190 updated
security flaw
-
Red Hat Enterprise Linux ES version 2.1 Red Hat Enterprise Linux WS version 2.1fixed: vendor fix RHSA-2003:224
-
Red Hat Linux 7.1 Red Hat Linux 7.2 Red Hat Linux 7.3 Red Hat Linux 8.0 Red Hat Linux 9fixed: vendor fix RHSA-2003:222
-
Red Hat Linux Advanced Workstation 2.1fixed: vendor fix RHSA-2003:224
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-22-349-21 updated cvss 5.3
Siemens SCALANCE X-200RNA Switch Devices
-
Siemens SCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2) <V3.2.7 Siemens SCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2) <V3.2.7 Siemens SCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3) <V3.2.7 Siemens SCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3) <V3.2.7 Siemens SCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3) <V3.2.7affected: fixed in V3.2.7, mitigation support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
Timeline
- First public exploit (EDB-25)
- Published
Exploit prediction
76.75% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/scanner/ssh/ssh_enumusers SSH Username Enumeration metasploit auxiliary, normal rank
- EDB-3303 Portable OpenSSH 3.6.1p-PAM/4.1-SuSE - Timing Attack remote, 2007-02-13
- EDB-26 OpenSSH/PAM 3.6.1p1 - 'gossh.sh' Remote Users Ident remote, 2003-05-02
- EDB-25 OpenSSH/PAM 3.6.1p1 - Remote Users Discovery Tool remote, 2003-04-30
- securityfocus.com http://www.securityfocus.com/bid/7467 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-203 Observable Discrepancy
References
-
securityfocus.com
/bid/7467
vdb-entry, broken-link, exploit, patch, third-party-advisory, vendor-advisory
-
redhat.com
/support/errata/RHSA-2003-222.html
vendor-advisory, broken-link
-
redhat.com
/support/errata/RHSA-2003-224.html
vendor-advisory, broken-link
-
turbolinux.com
/security/TLSA-2003-31.txt
vendor-advisory, broken-link
-
marc.info
/?l=bugtraq&m=105172058404810&w=2
mailing-list, third-party-advisory
-
marc.info
/?l=bugtraq&m=106018677302607&w=2
mailing-list, third-party-advisory
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A445
vdb-entry, signature, broken-link
-
lab.mediaservice.net
/advisory/2003-01-openssh.txt
broken-link
-
lists.grok.org.uk
/pipermail/full-disclosure/2003-April/004815.html
mailing-list, broken-link
-
cert-portal.siemens.com
/productcert/pdf/ssa-412672.pdf
third-party-advisory
Sources
- CVE List CVE-2003-0190
- NVD CVE-2003-0190
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.