Little feature/bug in RedHat Linux

[anttix () cyberix edu ee (Antti Andreimann)]

Hi!

I have discovered that an interesting "feature" exists in redhat-4.0
Impact:
Remote Users can find out what accounts exist in system by using login
services (telnet for example).
Reason:
When login get's unknown username error from PAM library it will die immediately
Example:
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.

Red Hat Linux release 4.0 (Colgate)
Kernel 2.0.24 on an i586
login: bug
Password:

Login incorrect
Connection closed by foreign host.
When submitted with a correct username, login will behave normally :
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.

Red Hat Linux release 4.0 (Colgate)
Kernel 2.0.24 on an i586
login: root
Password:
Login incorrect

login:
login:
login:
login:
--
========================================================================

            \||||||||||/                    Antti Andreimann
          \||||||||||||||/                  aka. Cyber
       \|||||||||||||||||\                  anttix () cyberix edu ee
       /||||||||||||||||0\__@     ______
       /|||||||||||||||||__/     (______)   Redistribution via microsoft
        \||||||||||||||||/          {}      network is prohibited .
(c)siil    L L       L L           _||_
========================================================================