CVE-2013-4434

Dropbear SSH Server before 2013.59 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to discover valid usernames.

• CWE-189

• http://lists.opensuse.org/opensuse-updates/2013-10/msg00061.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00046.htmlThird Party Advisory
• http://secunia.com/advisories/55173Vendor Advisory
• http://www.openwall.com/lists/oss-security/2013/10/16/11Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/62993Third Party Advisory, VDB Entry
• https://matt.ucc.asn.au/dropbear/CHANGESVendor Advisory
• https://secure.ucc.asn.au/hg/dropbear/rev/d7784616409aPatch, Third Party Advisory
• https://support.citrix.com/article/CTX216642Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00061.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00046.htmlThird Party Advisory
• http://secunia.com/advisories/55173Vendor Advisory
• http://www.openwall.com/lists/oss-security/2013/10/16/11Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/62993Third Party Advisory, VDB Entry
• https://matt.ucc.asn.au/dropbear/CHANGESVendor Advisory
• https://secure.ucc.asn.au/hg/dropbear/rev/d7784616409aPatch, Third Party Advisory
• https://support.citrix.com/article/CTX216642Third Party Advisory

Published

Oct 25, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4428OpenStack Image Registry and Delivery Service (Glance) Folso…
• CVE-2013-4429Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1…
• CVE-2013-4430Cross-site scripting (XSS) vulnerability in Mahara before 1.…
• CVE-2013-4431Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1…
• CVE-2013-4432Mahara before 1.5.13, 1.6.x before 1.6.8, and 1.7.x before 1…
• CVE-2013-4433Cross-site scripting (XSS) vulnerability in XHProf before 0.…
• CVE-2013-4435Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote aut…
• CVE-2013-4436The default configuration for salt-ssh in Salt (aka SaltStac…
• CVE-2013-4437Unspecified vulnerability in salt-ssh in Salt (aka SaltStack…
• CVE-2013-4438Salt (aka SaltStack) before 0.17.1 allows remote attackers t…
• CVE-2013-4439Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows rem…
• CVE-2013-4440Password Generator (aka Pwgen) before 2.07 generates weak no…