Fluid Attacks Database

Description

Dropbear SSH Server before 2013.59 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to discover valid usernames.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 13	dropbear	>=0 <2012.55-1.4	2012.55-1.4
debian 11	dropbear	>=0 <2012.55-1.4	2012.55-1.4
debian 12	dropbear	>=0 <2012.55-1.4	2012.55-1.4
debian 14	dropbear	>=0 <2012.55-1.4	2012.55-1.4

Aliases

1. CVE-2013-44342. NVD-2013-44343. OSV-DEBIAN-2013-44344. OSV-2013-44345. SECURITY-TRACKER-CVE-2013-4434

References

1. https://github.com/styx00/Dropbear_CVE-2013-4434

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.