Dropbear SSH 'svr-auth.c' User Enumeration Weakness

Bugtraq ID:	62993
Class:	Design Error
CVE:	CVE-2013-4434
Remote:	Yes
Local:	No
Published:	Oct 10 2013 12:00AM
Updated:	Sep 09 2016 03:00PM
Credit:	Logan Lamb
Vulnerable:	S.u.S.E. openSUSE 12.3 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Dropbear Dropbear SSH 2013.58 Citrix NetScaler T1 0 Citrix NetScaler Service Delivery Appliance 0 Citrix NetScaler Gateway 0 Citrix NetScaler Application Delivery Controller (ADC) 0 Citrix Command Center Appliance 0 Citrix CloudBridge 0
Not Vulnerable:	Dropbear Dropbear SSH 2013.59

Dropbear SSH 'svr-auth.c' User Enumeration Weakness

Dropbear SSH is prone to a user-enumeration weakness.

An attacker may leverage this issue to harvest valid usernames, which may aid in further attacks.

Dropbear SSH 'svr-auth.c' User Enumeration Weakness

An attacker can exploit this issue by supplying the application with crafted requests.

Dropbear SSH 'svr-auth.c' User Enumeration Weakness

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Mandriva Business Server 1 X86 64

• Mandriva dropbear-2013.59-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/

Dropbear SSH 'svr-auth.c' User Enumeration Weakness

References:

• Dropbear SSH 2013.59 (Dropbear)
  
• Dropbear SSH Server Homepage (Dropbear)
  
• Re: CVE Request: dropbear sshd daemon 2013.59 release (SecLists.Org)
  
• CTX216642 Multiple Security Vulnerabilities in Citrix NetScaler Platform IPMI Li (Citrix)