An issue was discovered in Dropbear through 2020.81. Due to a non-RFC-compliant check of the available authentication methods in the client-side SSH code, it is possible for an SSH server to change the login process in its favor. This attack can bypass additional security measures such as FIDO2 tokens or SSH-Askpass. Thus, it allows an attacker to abuse a forwarded agent for logging on to another server unnoticed.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Dropbear through 2020.81. Due to a non-RFC-compliant check of the available     authentication methods in the client-side SSH code, it is possible for an SSH server to change the login     process in its favor. This attack can bypass additional security measures such as FIDO2 tokens or SSH-     Askpass. Thus, it allows an attacker to abuse a forwarded agent for logging on to another server     unnoticed. (CVE-2021-36369)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7292-1 advisory.

    Manfred Kaiser discovered that Dropbear through 2020.81 does not properly check the available     authentication methods in the client-side SSH code. An attacker could use this vulnerability to gain     unauthorized access to remote systems. (CVE-2021-36369)

    Fabian Bumer, Marcus Brinkmann, and Jrg Schwenk discovered that the SSH transport protocol     implementation in Dropbear had weak integrity checks. An attacker could use this vulnerability to bypass     security features like encryption and integrity checks. (CVE-2023-48795)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3187 advisory.

    -lts-announce@lists.debian.org     Subject: [SECURITY] [DLA 3187-1] dropbear security update

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-3187-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     November 14, 2022                           https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : dropbear     Version        : 2018.76-5+deb10u2     CVE ID         : CVE-2021-36369

    An issue was discovered in Dropbear, a relatively small SSH server and     client. Due to a non-RFC-compliant check of the available authentication     methods in the client-side SSH code, it was possible for an SSH server     to change the login process in its favor. This attack can bypass     additional security measures such as FIDO2 tokens or SSH-Askpass. Thus,     it allows an attacker to abuse a forwarded agent for logging on to     another server unnoticed.

    For Debian 10 buster, this problem has been fixed in version     2018.76-5+deb10u2.

    We recommend that you upgrade your dropbear packages.

    For the detailed security status of dropbear please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/dropbear

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
224111	Linux Distros Unpatched Vulnerability : CVE-2021-36369	Nessus	Misc.	high
216761	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Dropbear vulnerabilities (USN-7292-1)	Nessus	Ubuntu Local Security Checks	critical
167353	Debian dla-3187 : dropbear - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-36369

high

Tenable Plugins

high

critical

high