OpenSSH < 7

Tenable plugin 159490 maps to CVE-2018-15473, an OpenSSH username enumeration bug. On OpenSSH versions through 7.7 upstream, a malformed authentication packet can trigger different server behavior for valid versus invalid usernames, letting an unauthenticated remote attacker test whether an account exists. Upstream fixed it in OpenSSH 7.8 on 2018-08-24, and major distros also backported the fix to older package branches.

The vendor's MEDIUM label is defensible on paper but too generous for enterprise patch triage. This bug does not grant authentication bypass, code execution, file access, or denial of service; it only improves attacker recon. In real environments, valid usernames are often guessable from email formats, directory naming, VPN portals, or prior phishing data, so the incremental value of this leak is usually modest.

Why this verdict

• Recon-only outcome: the bug discloses valid usernames and stops there; there is no auth bypass, RCE, file read, or service kill.
• Attack-chain friction: real harm requires separate follow-on weaknesses such as password auth exposure, weak credentials, or identity controls failing later.
• Reachability narrows the population: only SSH services reachable from the attacker matter, and many enterprise SSH endpoints sit behind VPN, bastions, or admin network controls.
• Backport noise lowers urgency: Tenable explicitly relies on banner versioning, so many Linux distributions may already be patched while still appearing < 7.8.

Why not higher?

If this were a pre-auth code execution or auth bypass on internet-facing SSH, it would be a different conversation. But enumeration alone is a support function for other attacks, and the blast radius is bounded by how much value a valid username list adds in your environment.

Why not lower?

It is still unauthenticated and network reachable, and exposed SSH is common enough that attackers can cheaply probe it. For orgs with password-auth remnants, predictable usernames, or externally reachable admin planes, the finding has some real operational value to adversaries.

1. Restrict SSH exposure — Move administrative SSH behind VPN, bastions, or source-IP allowlists. For a LOW finding there is no SLA; treat this as backlog hygiene, but it is the cleanest way to erase the attack surface entirely.
2. Disable password authentication where possible — Force key-based auth or certificate-based access so enumerated usernames cannot be turned directly into password-spray opportunities. For LOW, fold this into your normal hardening cycle rather than a break-fix push.
3. Throttle and alert on SSH auth bursts — Use MaxStartups, fail2ban, PAM rate controls, or perimeter controls to make username harvesting and follow-on spraying noisy and expensive. No formal mitigation deadline applies here, but this is a worthwhile control improvement during routine platform maintenance.
4. Validate package backports before opening change tickets — Check distro package metadata, not just the SSH banner, because Ubuntu/Debian often ship fixed builds on older upstream-looking versions. This prevents wasting patch windows on already-remediated hosts.

Run this on the target Linux host with local shell access. Invoke it as bash check_cve_2018_15473.sh; no root is required for package checks, but root may be needed on some systems to read service binaries or package metadata consistently. The script prefers distro package status over the raw SSH banner and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# check_cve_2018_15473.sh
# Determine likely exposure to CVE-2018-15473 (OpenSSH username enumeration)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

say() { printf '%s\n' "$*"; }
unknown() { say "UNKNOWN: $*"; exit 2; }
patched() { say "PATCHED: $*"; exit 0; }
vuln() { say "VULNERABLE: $*"; exit 1; }

have() { command -v "$1" >/dev/null 2>&1; }

get_ssh_banner() {
  local out
  out="$(ssh -V 2>&1 || true)"
  if [ -n "$out" ]; then
    printf '%s' "$out"
    return 0
  fi
  return 1
}

# Compare Debian package versions if dpkg is present
check_dpkg() {
  local pkg ver id ver_id
  have dpkg-query || return 1

  pkg="openssh-server"
  if ! dpkg-query -W -f='${Status} ${Version}\n' "$pkg" >/tmp/cve15473_dpkg.$$ 2>/dev/null; then
    return 1
  fi

  read -r _ _ _ ver < /tmp/cve15473_dpkg.$$ || true
  rm -f /tmp/cve15473_dpkg.$$
  [ -n "${ver:-}" ] || unknown "Could not read dpkg version for $pkg"

  id=""
  ver_id=""
  if [ -r /etc/os-release ]; then
    . /etc/os-release
    id="${ID:-}"
    ver_id="${VERSION_ID:-}"
  fi

  case "$id:$ver_id" in
    ubuntu:18.04)
      dpkg --compare-versions "$ver" ge "1:7.6p1-4ubuntu0.1" && patched "$pkg $ver on Ubuntu 18.04 meets fixed backport floor" || vuln "$pkg $ver on Ubuntu 18.04 is below fixed backport floor 1:7.6p1-4ubuntu0.1"
      ;;
    ubuntu:16.04)
      dpkg --compare-versions "$ver" ge "1:7.2p2-4ubuntu2.6" && patched "$pkg $ver on Ubuntu 16.04 meets fixed backport floor" || vuln "$pkg $ver on Ubuntu 16.04 is below fixed backport floor 1:7.2p2-4ubuntu2.6"
      ;;
    ubuntu:14.04)
      dpkg --compare-versions "$ver" ge "1:6.6p1-2ubuntu2.11" && patched "$pkg $ver on Ubuntu 14.04 meets fixed backport floor" || vuln "$pkg $ver on Ubuntu 14.04 is below fixed backport floor 1:6.6p1-2ubuntu2.11"
      ;;
    debian:9)
      dpkg --compare-versions "$ver" ge "1:7.4p1-10+deb9u4" && patched "$pkg $ver on Debian 9 meets fixed backport floor" || vuln "$pkg $ver on Debian 9 is below fixed backport floor 1:7.4p1-10+deb9u4"
      ;;
    debian:11)
      dpkg --compare-versions "$ver" ge "1:8.4p1-5+deb11u3" && patched "$pkg $ver on Debian 11 meets tracker fixed floor" || vuln "$pkg $ver on Debian 11 is below tracker fixed floor 1:8.4p1-5+deb11u3"
      ;;
    ubuntu:*|debian:*)
      unknown "$pkg $ver installed on $id $ver_id; distro present but not mapped in this lightweight checker. Validate against vendor security tracker."
      ;;
    *)
      return 1
      ;;
  esac
}

# Fallback: inspect SSH client banner only; may be wrong for server and wrong with backports
check_banner_fallback() {
  local banner base
  banner="$(get_ssh_banner || true)"
  [ -n "$banner" ] || unknown "No package metadata and no ssh banner available"

  case "$banner" in
    *OpenSSH_7.8*|*OpenSSH_7.9*|*OpenSSH_8.*|*OpenSSH_9.*)
      patched "Banner suggests $banner (upstream 7.8+), but confirm server package on distro-managed hosts"
      ;;
    *OpenSSH_7.7*|*OpenSSH_7.6*|*OpenSSH_7.5*|*OpenSSH_7.4*|*OpenSSH_7.3*|*OpenSSH_7.2*|*OpenSSH_7.1*|*OpenSSH_7.0*|*OpenSSH_6.*|*OpenSSH_5.*|*OpenSSH_4.*|*OpenSSH_3.*|*OpenSSH_2.*)
      unknown "Banner suggests potentially affected upstream version ($banner), but distro backports can make this a false positive"
      ;;
    *)
      unknown "Unrecognized SSH banner: $banner"
      ;;
  esac
}

check_dpkg || check_banner_fallback
unknown "Unable to determine patch state"

Sources

1. Tenable Nessus Plugin 159490
2. OpenSSH release notes
3. Openwall disclosure from Qualys
4. Ubuntu CVE page with backported fixed versions
5. Debian security tracker for CVE-2018-15473
6. NVD CVE-2018-15473
7. CISA Known Exploited Vulnerabilities Catalog
8. CIRCL Vulnerability-Lookup entry with EPSS snapshot