{
  "modified": "2025-08-09T19:01:28Z",
  "published": "2003-05-12T04:00:00Z",
  "id": "CVE-2003-0190",
  "details": "OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.",
  "references": [
    {
      "type": "ADVISORY",
      "url": "http://lab.mediaservice.net/advisory/2003-01-openssh.txt"
    },
    {
      "type": "ADVISORY",
      "url": "http://marc.info/?l=bugtraq\u0026m=105172058404810\u0026w=2"
    },
    {
      "type": "ADVISORY",
      "url": "http://marc.info/?l=bugtraq\u0026m=106018677302607\u0026w=2"
    },
    {
      "type": "ADVISORY",
      "url": "http://www.securityfocus.com/bid/7467"
    },
    {
      "type": "ADVISORY",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
    },
    {
      "type": "EVIDENCE",
      "url": "http://www.securityfocus.com/bid/7467"
    },
    {
      "type": "FIX",
      "url": "http://www.securityfocus.com/bid/7467"
    },
    {
      "type": "WEB",
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-April/004815.html"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2003-222.html"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2003-224.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/7467"
    },
    {
      "type": "WEB",
      "url": "http://www.turbolinux.com/security/TLSA-2003-31.txt"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A445"
    }
  ]
}