Published: 25/10/2013 Updated: 30/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Dropbear SSH Server prior to 2013.59 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote malicious users to discover valid usernames.

Vulnerable Product	Search on Vulmon	Subscribe to Product
dropbear ssh project dropbear ssh

Debian Bug report logs - #726118 dropbear: CVE-2013-4434: Avoid disclosing existence of valid users through inconsistent delays Package: dropbear; Maintainer for dropbear is Guilhem Moulin <guilhem@debianorg>; Source for dropbear is src:dropbear (PTS, buildd, popcon) Reported by: Henri Salo <henri@nervfi> Date: Sat ...

Description of Problem A number of security vulnerabilities have been identified in firmware used in the Lights Out Management (LOM) component across all NetScaler-based hardware appliances: Citrix NetScaler Application Delivery Controller (ADC) Citrix NetScaler Gateway Citrix NetScaler Service Delivery Appliance Citrix CloudBridge (now NetScaler S ...

Dropbear user enumeration (CVE-2013-4434) PoC

Dropbear_CVE-2013-4434 dropbear_CVE-2013-4434sh This script checks for [CVE-2013-4434] (cvemitreorg/cgi-bin/cvenamecgi?name=CVE-2013-4434) Dropbear SSH Server before 201359 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to discover valid usernames

CWE-189 https://matt.ucc.asn.au/dropbear/CHANGES http://secunia.com/advisories/55173 https://secure.ucc.asn.au/hg/dropbear/rev/d7784616409a http://www.openwall.com/lists/oss-security/2013/10/16/11 http://lists.opensuse.org/opensuse-updates/2013-10/msg00061.html http://lists.opensuse.org/opensuse-updates/2013-11/msg00046.html http://www.securityfocus.com/bid/62993 https://support.citrix.com/article/CTX216642 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=726118 https://nvd.nist.gov https://github.com/styx00/Dropbear_CVE-2013-4434

CVE-2013-4434

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect