openssh-5.3p1-123.AXS4

OpenSSH is an SSH protocol implementation supported by a number of Linux,
UNIX, and similar operating systems. It includes the core files necessary for
both the OpenSSH client and server.

Security Fix(es):

* A covert timing channel flaw was found in the way OpenSSH handled
authentication of non-existent users. A remote unauthenticated attacker could
possibly use this flaw to determine valid user names by measuring the timing of
server responses. (CVE-2016-6210)

CVE-2016-6210
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user
password hashing, uses BLOWFISH hashing on a static password when the
username does not exist, which allows remote attackers to enumerate
users by leveraging the timing difference between responses when a
large password is provided.