BID:10803

Dropbear SSH Server Digital Signature Standard Unspecified Authentication Vulnerability

Info

Dropbear SSH Server Digital Signature Standard Unspecified Authentication Vulnerability

Bugtraq ID:	10803
Class:	Unknown
CVE:	CVE-2004-2486
Remote:	Yes
Local:	No
Published:	Jul 26 2004 12:00AM
Updated:	Feb 14 2008 05:45PM
Credit:	The individual responsible for disclosure of this issue is currently unknown; the vendor disclosed this issue.
Vulnerable:	Dropbear SSH Server 0.42 Dropbear SSH Server 0.41 Dropbear SSH Server 0.40 Dropbear SSH Server 0.39 Dropbear SSH Server 0.38 Dropbear SSH Server 0.37 Dropbear SSH Server 0.36 Dropbear SSH Server 0.35 Dropbear SSH Server 0.34 Dropbear SSH Server 0.33 Dropbear SSH Server 0.32 Dropbear SSH Server 0.31 Dropbear SSH Server 0.30 Dropbear SSH Server 0.29 Dropbear SSH Server 0.28 Cisco Unified IP Phone 7971G Cisco Unified IP Phone 7970G Cisco Unified IP Phone 7961G Cisco Unified IP Phone 7941G Cisco Unified IP Phone 7911G Cisco Unified IP Phone 7906G

Not Vulnerable:	Dropbear SSH Server 0.43 Cisco Unified IP Phone SCCP 8.2(2)SR2

Discussion

Dropbear SSH Server Digital Signature Standard Unspecified Authentication Vulnerability

Dropbear SSH is affected by an unspecified Digital Signal Standard (DSS) authentication vulnerability.

The impact of this issue is currently unknown. Presumably, an attacker could use this issue to gain unauthorized access to a computer running the vulnerable application, but this is not confirmed. We will update this BID as more information emerges.

Exploit / POC

Dropbear SSH Server Digital Signature Standard Unspecified Authentication Vulnerability

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

Dropbear SSH Server Digital Signature Standard Unspecified Authentication Vulnerability

Solution:
The vendor has released an upgrade dealing with this issue.

Dropbear SSH Server 0.28