CVE-2016-6210

What it actually does

Remote attackers can enumerate valid usernames by observing timing differences in SSH authentication responses; non-existent usernames trigger BLOWFISH hashing of a static password while valid usernames use the configured SHA256/SHA512 method when a large password is supplied.

Why it matters to the business

Attackers gain knowledge of legitimate account names, enabling more focused follow-on attacks such as credential stuffing or social engineering that can result in account compromise and unauthorized system access.

How an attack unfolds

An attacker repeatedly connects to the SSH service supplying a very long password string paired first with guessed or enumerated usernames and then with known-invalid usernames, measures the elapsed time until the server responds, and uses statistically significant timing deltas to distinguish real accounts from non-existent ones.

How to fix it

Upgrade OpenSSH to version 7.3 or later. For apache (Bitnami) installations, upgrade to version 2.4.46 which contains the corrected OpenSSH component.

How to confirm the fix worked

Verify the installed OpenSSH version is 7.3 or newer; re-test authentication timing with large passwords for both valid and invalid usernames to confirm uniform response latency.

Typical attack path

1. Establish multiple SSH authentication attempts to the target service
2. Submit a large password payload with candidate usernames
3. Record response latency for each attempt
4. Compare latencies between known-invalid and candidate usernames
5. Compile list of usernames that exhibit the slower hashing path

How to detect it

Review SSH daemon logs for clusters of authentication attempts that include both valid and invalid usernames accompanied by unusually long password fields; correlate source IP addresses across multiple username probes.

• sshd.*Failed password for invalid user.*from
• sshd.*input_userauth_request: invalid user

What your security team should do

• Apply the vendor-supplied upgrade to 7.3+ (or apache Bitnami 2.4.46) on all affected systems within the next maintenance window
• Enable SSH logging of authentication attempts and monitor for high volumes of failed logins using long password strings
• Consider rate-limiting or fail2ban-style protections on the SSH service until patches are deployed