CVE-2013-4434

MEDIUM 5.0CVE-2013-4434 · Published 25/10/2013 · updated 16/06/2026

Package	Affected versions	Patched versions
dropbear ssh dropbear_ssh_project	`< 2013.59`	`2013.59`

Description

Dropbear SSH Server before 2013.59 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to discover valid usernames.

References

lists.opensuse.org/opensuse-updates/2013-10/msg00061.html · Third Party Advisory
lists.opensuse.org/opensuse-updates/2013-11/msg00046.html · Third Party Advisory
secunia.com/advisories/55173 · Vendor Advisory
openwall.com/lists/oss-security/2013/10/16/11 · Mailing List
securityfocus.com/bid/62993 · Third Party Advisory
matt.ucc.asn.au/dropbear/CHANGES · Vendor Advisory
secure.ucc.asn.au/hg/dropbear/rev/d7784616409a · Patch
support.citrix.com/article/CTX216642 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free