PT-2019-8553 · Dropbear · Dropbear

Published 2019-03-20 · Updated 2019-10-09 · CVE-2017-2659

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions dropbear versions prior to 2013.59

Description The issue allows an attacker to determine whether a given username is valid or not by exploiting the GSSAPI authentication mechanism. When an invalid username is provided, the authentication failure is incorrectly counted towards the maximum allowed number of password attempts.

Recommendations For versions prior to 2013.59, update to version 2013.59 or later to resolve the issue.

Fix

Improper Authentication

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-287

CWE-209

Related Identifiers

CVE-2017-2659

Affected Products

Dropbear

References · 9

• https://security-tracker.debian.org/tracker/CVE-2017-2659 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-2659 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2659 · Security Note
• https://secure.ucc.asn.au/hg/dropbear/rev/d7784616409a#l1.86 · Patch
• https://cve.org/CVERecord?id=CVE-2017-2659 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2659 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-2659 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2659 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-2659 · Vendor Advisory