Bug 1433824 (CVE-2017-2659)

Summary:	CVE-2017-2659 dropbear: Information leak when given invalid username
Product:	[Other] Security Response	Reporter:	Doran Moppert <dmoppert>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	buytenh, daniellarasouza, i, itamar, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	dropbear 2013.59	Doc Type:	If docs needed, set a value
Doc Text:	It was found that dropbear, with GSSAPI, leaks whether the given username is valid or invalid. When an invalid username is given, the GSSAPI authentication failure was incorrectly counted towards the maximum allowed number of password attempts.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-21 11:52:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Doran Moppert 2017-03-20 03:07:25 UTC

It was found that dropbear with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI authentication failure was incorrectly counted towards the maximum allowed number of password attempts.

This was fixed in dropbear-2013.59, as part of the following patch:

https://secure.ucc.asn.au/hg/dropbear/rev/d7784616409a#l1.86

Comment 1 Doran Moppert 2017-03-20 03:11:35 UTC

Acknowledgments:

Name: Gilford Martino (Bae Systems), Scott McKee (Bae Systems)

Comment 2 Doran Moppert 2019-03-18 02:53:05 UTC

External References:

https://secure.ucc.asn.au/hg/dropbear/rev/d7784616409a#l1.86