CVE-2013-4434: Medium severity dropbear ssh vulnerability
Published Oct 25, 2013
·Updated
Dropbear SSH Server before 2013.59 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to discover valid usernames.
Affected Software
1 affected component
Dropbear Ssh Project Dropbear Ssh<2013.59
Remediation
Patch Available
Event History
Oct 25, 2013
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-4434?
CVE-2013-4434 is classified as a medium severity vulnerability due to the potential for username enumeration.
2
How do I fix CVE-2013-4434?
To fix CVE-2013-4434, upgrade the Dropbear SSH Server to version 2013.59 or later.
3
What does CVE-2013-4434 allow attackers to do?
CVE-2013-4434 allows remote attackers to potentially discover valid usernames by observing the timing of error messages during failed login attempts.
4
Which versions of Dropbear SSH are affected by CVE-2013-4434?
CVE-2013-4434 affects all versions of Dropbear SSH before 2013.59.
5
Is CVE-2013-4434 a configuration issue?
CVE-2013-4434 is a vulnerability in the Dropbear SSH server implementation, not a configuration issue.