CVE-2013-4434

NONE

Published Oct 25, 201312y ago · Modified Jun 16, 20262w ago

Published Oct 25, 2013 12y ago

Last Modified Jun 16, 2026 2w ago

Description

Dropbear SSH Server before 2013.59 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to discover valid usernames.

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-189

Affected Products 1

Vendor	Product	Version	Range
dropbear_ssh_project	dropbear_ssh	*	<2013.59

References 8

lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2013-10/msg00061.html

Third Party Advisory
lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2013-11/msg00046.html

Third Party Advisory
secunia.com http://secunia.com/advisories/55173

Vendor Advisory
openwall.com http://www.openwall.com/lists/oss-security/2013/10/16/11

Mailing ListThird Party Advisory
securityfocus.com http://www.securityfocus.com/bid/62993

Third Party AdvisoryVDB Entry
matt.ucc.asn.au https://matt.ucc.asn.au/dropbear/CHANGES

Vendor Advisory
secure.ucc.asn.au https://secure.ucc.asn.au/hg/dropbear/rev/d7784616409a

PatchThird Party Advisory
support.citrix.com https://support.citrix.com/article/CTX216642

Third Party Advisory

Remediation

secure.ucc.asn.au https://secure.ucc.asn.au/hg/dropbear/rev/d7784616409a

PatchThird Party Advisory