CVE-2006-5229: OpenSSH username enumeration via timing discrepancy

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

low priorityThe flaw only exposes valid usernames under possibly limited configurations, with low CVSS severity and no KEV listing, though the high EPSS score warrants monitoring.

What it is

OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, can leak valid usernames through timing differences: responses for valid usernames take longer than for invalid ones. The record notes the issue may depend on limited configurations, specifically manually-set passwords that cause delays when processing /etc/shadow due to an increased number of rounds. This matters because it gives an unauthenticated attacker a way to build a list of valid accounts for later targeting.

Impact

An attacker gains only username disclosure, not code execution or data modification; the CVSS 2.0 vector confirms partial confidentiality impact with no integrity or availability impact. The value is reconnaissance: valid usernames feed password guessing, credential stuffing or social engineering.

Attack surface

Reachable remotely over the network against the SSH service, with no authentication required (AV:N/Au:N). No user interaction is described; the attacker simply measures response timing, and the flaw may only appear under limited configurations such as manually-set passwords.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded. EPSS is high (0.57426, 99th percentile), but the references are advisories and mailing-list threads with no public exploit tag, so treat the EPSS score as a signal of attention rather than confirmed in-the-wild exploitation.

What to do

• Patch or upgrade OpenSSH to a current supported release; the record does not list fixed versions, so confirm the fix with your vendor.
• Where patching is not immediate, restrict SSH exposure to trusted networks and require key-based authentication.
• Review whether manually-set passwords with high hash rounds are in use, since the record ties the timing gap to that configuration.
• Monitor and rate-limit repeated SSH authentication attempts from single sources to blunt username harvesting.
• Retire or isolate end-of-life OpenSSH 4.1 deployments, particularly on SUSE Linux.

Detection

• Baseline SSH authentication response times per source and alert on repeated timing patterns consistent with username enumeration.
• Correlate many failed SSH logins across a range of usernames from one source, which often follows successful enumeration.
• Watch for use of known enumeration tooling such as sshtime against exposed SSH services.
• Review SSH logs for sequential or dictionary-like username probing from single IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.