daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/cves/2016/CVE-2016-6210.yaml

33 lines
934 B
YAML
Raw Normal View History

Add CVE information
2021-09-30 19:42:07 +00:00
id: CVE-2016-6210
detect openssh5.3
2021-04-11 13:02:20 +00:00
info:
Update SSH user enum templates SSH header structure: SSH-protoversion-softwareversion[SPcomments]CRLF see: https://datatracker.ietf.org/doc/html/rfc4253#section-4.2
2021-11-01 18:34:47 +00:00
name: OpenSSH username enumeration < v7.3
author: iamthefrogy,forgedhallpass
Add CVE information
2021-09-30 19:42:07 +00:00
severity: medium
Update SSH user enum templates SSH header structure: SSH-protoversion-softwareversion[SPcomments]CRLF see: https://datatracker.ietf.org/doc/html/rfc4253#section-4.2
2021-11-01 18:34:47 +00:00
description: OpenSSH before 7.3 is vulnerable to username enumeration and DoS vulnerabilities.
Removed pipe (|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84
2021-08-18 11:37:49 +00:00
reference:
Satisfying the linter (all errors and warnings) * whitespace modifications only
2021-08-19 14:44:46 +00:00
- http://seclists.org/fulldisclosure/2016/Jul/51
- https://security-tracker.debian.org/tracker/CVE-2016-6210
- http://openwall.com/lists/oss-security/2016/08/01/2
Update SSH user enum templates SSH header structure: SSH-protoversion-softwareversion[SPcomments]CRLF see: https://datatracker.ietf.org/doc/html/rfc4253#section-4.2
2021-11-01 18:34:47 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2016-6210
Add CVE information
2021-09-30 19:42:07 +00:00
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 5.9
cve-id: CVE-2016-6210
cwe-id: CWE-200
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
tags: cve,cve2016,network,openssh
detect openssh5.3
2021-04-11 13:02:20 +00:00
network:
- host:
minor updates
2021-04-11 13:16:48 +00:00
- "{{Hostname}}"
Network template updates & fixes (#3497) * Fixed template syntax * network template update and fixes
2022-01-07 07:28:37 +00:00
- "{{Host}}:22"
CVE-2016-6210 - Fix typo in the regex (#3365) * CVE-2016-6210 - Fix typo in the regex * minor variable update Co-authored-by: ganoes <karel.rozhon@etnetera.cz> Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2021-12-18 09:28:35 +00:00
detect openssh5.3
2021-04-11 13:02:20 +00:00
matchers:
Update SSH user enum templates SSH header structure: SSH-protoversion-softwareversion[SPcomments]CRLF see: https://datatracker.ietf.org/doc/html/rfc4253#section-4.2
2021-11-01 18:34:47 +00:00
- type: regex
regex:
CVE-2016-6210 - Fix typo in the regex (#3365) * CVE-2016-6210 - Fix typo in the regex * minor variable update Co-authored-by: ganoes <karel.rozhon@etnetera.cz> Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2021-12-18 09:28:35 +00:00
- '(?i)SSH-2.0-OpenSSH_(?:[1-6][^\d][^\r\n]+|7\.[0-2][^\d][\n^\r]+)'
Update SSH user enum templates SSH header structure: SSH-protoversion-softwareversion[SPcomments]CRLF see: https://datatracker.ietf.org/doc/html/rfc4253#section-4.2
2021-11-01 18:34:47 +00:00
extractors:
- type: regex
regex:
CVE-2016-6210 - Fix typo in the regex (#3365) * CVE-2016-6210 - Fix typo in the regex * minor variable update Co-authored-by: ganoes <karel.rozhon@etnetera.cz> Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2021-12-18 09:28:35 +00:00
- '(?i)SSH-2.0-OpenSSH_[^\r\n]+'