CVE-2004-2486 The DSS verification code in Dropbear SSH Server before 0.43 frees uninitialized variables, which might allow remote attackers to gain access.
HighCVSS 7.5
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The DSS verification code in Dropbear SSH Server before 0.43 frees uninitialized variables, which might allow remote attackers to gain access.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dropbear ssh project dropbear ssh | < 0.43 | 0.43 |
| debian/dropbear(Debian:12) | < 0.43-2 | 0.43-2 |
| debian/dropbear(Debian:13) | < 0.43-2 | 0.43-2 |
| debian/dropbear(Debian:14) | < 0.43-2 | 0.43-2 |
References
- matt.ucc.asn.au vendor-advisory
- 12153 third-party-advisory
- 28935 third-party-advisory
- 20080213 Cisco Unified IP Phone Overflow and Denial of Service Vulnerabilities third-party-advisory vendor-advisory
- 8137 broken-link vdb-entry
- 10803 third-party-advisory vdb-entry
- ADV-2008-0543 third-party-advisory vdb-entry
- dropbear-dss-code-execution(16810) third-party-advisory vdb-entry
- cisco-unifiedipphone-ssh-bo(40490) third-party-advisory vdb-entry
- Debian Security Tracker CVE-2004-2486 vendor-advisory