OPIE W/ OpenSSH Account Enumeration The Remote Host Is Susceptible To An Information Disclosure Attack.

Home » CentOS » OPIE W/ OpenSSH Account Enumeration The Remote Host Is Susceptible To An Information Disclosure Attack.
CentOS 1 Comment

Hi,

I am running the openssh-server-7.4p1-21.el7.x86_64 on CentOS Linux release
7.9.2009 (Core).

#cat /etc/redhat-release CentOS Linux release 7.9.2009 (Core)
# rpm -qa |grep ssh openssh-server-7.4p1-21.el7.x86_64
libssh2-1.8.0-4.el7.x86_64
openssh-7.4p1-21.el7.x86_64
openssh-clients-7.4p1-21.el7.x86_64

While invoking the Vulnerability Assessment and Penetration Testing (VAPT)
scan, we are encountering the below vulnerability.

OPIE w/ OpenSSH Account Enumeration The remote host is susceptible to an

Any help will be highly appreciated. Thanks in Advance. Please let me know if you need any additional information.

Best Regards,

Kaushal
–

One thought on - OPIE W/ OpenSSH Account Enumeration The Remote Host Is Susceptible To An Information Disclosure Attack.

  • This vulnerability is a ‘useless’ one to test against unless you are either going to ‘exploit’ OPIE to confirm it is installed or have local access to the system to check. For the systems which show up like this you will need to see if OPIE has been installed on the systems. OPIE is not shipped with CentOS as far as I know but it could be installed aftermarket.

    if it was done with rpms’
    rpm -qa | grep -i opie

    otherwise you will need to look in /etc/pam.d

    grep -i open /etc/pam.d/*

    If it is installed, then this isn’t a CentOS issue as OPIE is not shipped but would be whoever added this to the systems problem.