PT-2013-5008 · Dropbear · Dropbear Ssh Server

Published 2013-10-25 · Updated 2018-10-30 · CVE-2013-4421

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Dropbear SSH Server versions prior to 2013.59

Description The issue allows remote attackers to cause a denial of service, specifically memory consumption, by sending a compressed packet with a large decompressed size.

Recommendations For versions prior to 2013.59, update to version 2013.59 or later to resolve the issue.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2013-4421

MGASA-2013-0318

Affected Products

Dropbear Ssh Server

References · 17

• http://lists.opensuse.org/opensuse-updates/2013-11/msg00046.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00061.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-4421 · Vendor Advisory
• https://matt.ucc.asn.au/dropbear/CHANGES · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119323.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119300.html · Vendor Advisory
• https://secure.ucc.asn.au/hg/dropbear/rev/0bf76f54de6f · Patch
• https://osv.dev/vulnerability/MGASA-2013-0318 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-4421 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4421 · Security Note
• https://advisories.mageia.org/MGASA-2013-0318.html · Security Note
• http://secunia.com/advisories/55173 · Note
• https://support.citrix.com/article/CTX216642 · Note
• https://bugs.mageia.org/show_bug.cgi?id=11442 · Note