Dropbear SSH Server before 2013.59 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to discover valid usernames.

dropbear was updated to version 2013.60 to fix following bugs :

  - Fix 'make install' so that it doesn't always install to     /bin and /sbin

  - Fix 'make install MULTI=1', installing manpages failed

  - Fix 'make install' when scp is included since it has no     manpage

  - Make --disable-bundled-libtom work

  - used as bug fix release for bnc#845306 - VUL-0:
    CVE-2013-4421 and CVE-2013-4434

  - provided links for download sources

  - employed gpg-offline - verify sources 

  - imported upstream version 2013.59

  - Fix crash from -J command Thanks to Llu&Atilde;&shy;s     Batlle i Rossell and Arnaud Mouiche for patches

  - Avoid reading too much from /proc/net/rt_cache since     that causes system slowness. 

  - Improve EOF handling for half-closed connections Thanks     to Catalin Patulea

  - Send a banner message to report PAM error messages     intended for the user Patch from Martin Donnelly

  - Limit the size of decompressed payloads, avoids memory     exhaustion denial of service Thanks to Logan Lamb for     reporting and investigating it

  - Avoid disclosing existence of valid users through     inconsistent delays Thanks to Logan Lamb for reporting

  - Update config.guess and config.sub for newer     architectures

  - Avoid segfault in server for locked accounts

  - 'make install' now installs manpages dropbearkey.8 has     been renamed to dropbearkey.1 manpage added for     dropbearconvert

  - Get rid of one second delay when running non-interactive     commands

Updated dropbear package fixes security vulnerability :

Possible memory exhaustion denial of service due to the size of decompressed payloads in dropbear before 2013.59 (CVE-2013-4421).

Inconsistent delays in authorization failures could be used to disclose the existence of valid user accounts in dropbear before 2013.59 (CVE-2013-4434).

According to its self-reported banner, the version of Dropbear SSH running on this port is earlier than 2013.59.  As such, it is potentially affected by multiple vulnerabilities :

  - A denial of service vulnerability caused by the way the     'buf_decompress()' function handles compressed files.
    (CVE-2013-4421)

  - User-enumeration is possible due to a timing error when     authenticating users. (CVE-2013-4434)

The Dropbear project reports :

A weakness and a vulnerability have been reported in Dropbear SSH Server, which can be exploited by malicious people to disclose certain sensitive information and cause a DoS.

ID	Name	Product	Family	Severity
75194	openSUSE Security Update : dropbear (openSUSE-SU-2013:1696-1)	Nessus	SuSE Local Security Checks	medium
75182	openSUSE Security Update : dropbear (openSUSE-SU-2013:1616-1)	Nessus	SuSE Local Security Checks	medium
70680	Mandriva Linux Security Advisory : dropbear (MDVSA-2013:261)	Nessus	Mandriva Local Security Checks	medium
70545	Dropbear SSH Server < 2013.59 Multiple Vulnerabilities	Nessus	Misc.	medium
70484	FreeBSD : dropbear -- exposure of sensitive information, DoS (8c9b48d1-3715-11e3-a624-00262d8b701d)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2013-4434

medium

Tenable Plugins

medium

medium

medium

medium

medium