The buf_decompress function in packet.c in Dropbear SSH Server before 2013.59 allows remote attackers to cause a denial of service (memory consumption) via a compressed packet that has a large size when it is decompressed.

dropbear was updated to version 2013.60 to fix following bugs :

  - Fix 'make install' so that it doesn't always install to     /bin and /sbin

  - Fix 'make install MULTI=1', installing manpages failed

  - Fix 'make install' when scp is included since it has no     manpage

  - Make --disable-bundled-libtom work

  - used as bug fix release for bnc#845306 - VUL-0:
    CVE-2013-4421 and CVE-2013-4434

  - provided links for download sources

  - employed gpg-offline - verify sources 

  - imported upstream version 2013.59

  - Fix crash from -J command Thanks to Llu&Atilde;&shy;s     Batlle i Rossell and Arnaud Mouiche for patches

  - Avoid reading too much from /proc/net/rt_cache since     that causes system slowness. 

  - Improve EOF handling for half-closed connections Thanks     to Catalin Patulea

  - Send a banner message to report PAM error messages     intended for the user Patch from Martin Donnelly

  - Limit the size of decompressed payloads, avoids memory     exhaustion denial of service Thanks to Logan Lamb for     reporting and investigating it

  - Avoid disclosing existence of valid users through     inconsistent delays Thanks to Logan Lamb for reporting

  - Update config.guess and config.sub for newer     architectures

  - Avoid segfault in server for locked accounts

  - 'make install' now installs manpages dropbearkey.8 has     been renamed to dropbearkey.1 manpage added for     dropbearconvert

  - Get rid of one second delay when running non-interactive     commands

New version/Unbundle libtom*/harden build/AArch64 support.

[edited]: CVE-2013-4421

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated dropbear package fixes security vulnerability :

Possible memory exhaustion denial of service due to the size of decompressed payloads in dropbear before 2013.59 (CVE-2013-4421).

Inconsistent delays in authorization failures could be used to disclose the existence of valid user accounts in dropbear before 2013.59 (CVE-2013-4434).

According to its self-reported banner, the version of Dropbear SSH running on this port is earlier than 2013.59.  As such, it is potentially affected by multiple vulnerabilities :

  - A denial of service vulnerability caused by the way the     'buf_decompress()' function handles compressed files.
    (CVE-2013-4421)

  - User-enumeration is possible due to a timing error when     authenticating users. (CVE-2013-4434)

New version/Unbundle libtom*/harden build/AArch64 support.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Dropbear project reports :

A weakness and a vulnerability have been reported in Dropbear SSH Server, which can be exploited by malicious people to disclose certain sensitive information and cause a DoS.

Dropbear is an SSH client and server application. The SSH server in versions of Dropbear earlier than 2013.59 are vulnerable potential denial of service due to a memory exhaustion that can be triggered by overly large compressed payloads. Additionally, a user enumeration weakness exists, due to the different response times generated between the login of an existing user versus a nonexistent user. Attackers could leverage this to enumerate logins on the machine.

ID	Name	Product	Family	Severity
75194	openSUSE Security Update : dropbear (openSUSE-SU-2013:1696-1)	Nessus	SuSE Local Security Checks	medium
75182	openSUSE Security Update : dropbear (openSUSE-SU-2013:1616-1)	Nessus	SuSE Local Security Checks	medium
70814	Fedora 20 : dropbear-2013.59-1.fc20 (2013-18703)	Nessus	Fedora Local Security Checks	medium
70680	Mandriva Linux Security Advisory : dropbear (MDVSA-2013:261)	Nessus	Mandriva Local Security Checks	medium
70545	Dropbear SSH Server < 2013.59 Multiple Vulnerabilities	Nessus	Misc.	medium
70508	Fedora 18 : dropbear-2013.59-1.fc18 (2013-18606)	Nessus	Fedora Local Security Checks	medium
70507	Fedora 19 : dropbear-2013.59-1.fc19 (2013-18593)	Nessus	Fedora Local Security Checks	medium
70484	FreeBSD : dropbear -- exposure of sensitive information, DoS (8c9b48d1-3715-11e3-a624-00262d8b701d)	Nessus	FreeBSD Local Security Checks	medium
8026	Dropbear SSH Memory Corruption Denial of Service and User Enumeration Weakness	Nessus Network Monitor	SSH	medium

Detections

Analytics

CVE-2013-4421

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium