{"id":16587,"date":"2021-07-08T10:48:18","date_gmt":"2021-07-08T08:48:18","guid":{"rendered":"https:\/\/herolab-usd.formwandler.rocks\/security-advisories\/usd-2018-0034\/"},"modified":"2021-07-19T14:09:55","modified_gmt":"2021-07-19T12:09:55","slug":"usd-2018-0034","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2018-0034\/","title":{"rendered":"usd-2018-0034"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.9.4\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\"][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n

usd-2018-0034 | Dropbear\/2011.54 up to 2019.77<\/span><\/h1>\n
<\/div>\n

<\/span>Advisory ID<\/strong>: usd-2018-0034<\/span>
CVE-ID<\/strong>: CVE-2019-12953<\/span>
Affected Product<\/strong>: Dropbear<\/span>
Affected Version<\/strong>: 2011.54 up to 2019.77<\/span>
Vulnerability Type<\/strong>: User Enumeration<\/span>
Security Risk<\/strong>: Low<\/span>
Vendor URL<\/strong>: <\/span>https:\/\/matt.ucc.asn.au\/dropbear\/dropbear.html<\/a>
Vendor Status<\/strong>: Fixed<\/span><\/p>\n

<\/h3>\n

Description<\/h3>\n

Description based on commit 6f6ef4834c792f7ccf2409080a6adaf44b8f0d51<\/a><\/p>\n

Dropbear does not crypt the password if the username is invalid. By sending
a long password, it is possible to measure time difference and enumerate
valid\/invalid usernames.<\/p>\n

<\/h3>\n

Proof of Concept (PoC)<\/h3>\n

Vulnerable code example:<\/span><\/p>\n

[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" hover_enabled=\"0\" sticky_enabled=\"0\"]svr-authpasswd.c<\/p>\n

password = buf_getstring(ses.payload, &amp;passwordlen);
\nif (valid_user) {
\n\/* the first bytes of passwdcrypt are the salt *\/
\npasswdcrypt = ses.authstate.pw_passwd;
\ntestcrypt = crypt(password, passwdcrypt);
\n}<\/code><\/pre>\n

[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n

\n
\n

Fix<\/h3>\n
\n
\n
\n

Make sure that the different branches in the authentication process all require the same execution time in order to hinder timing attacks.<\/p>\n<\/div>\n<\/div>\n<\/div>\n

<\/div>\n

<\/h3>\n

<\/h3>\n

Timeline<\/h3>\n
    \n
  • 2018-10-19 Daniel Hoffmann discovered the bug<\/li>\n
  • 2018-11-02 notification to matt@ucc.asn.au<\/li>\n
  • 2018-11-04 received response stating to fix the vulnerability<\/li>\n
  • 2018-11-05 the developer tried to mitigate the issue (commit 02ffdd09dc1941f7a924cde8db288fcd64987f59)<\/li>\n
  • 2019-01-07 verified that exploit still works (commit cb945f9f670e95305c7c5cc5ff344d1f2707b602)<\/li>\n
  • 2019-01-11 sent disclosure reminder<\/li>\n
  • 2019-01-30 Security advisory released<\/li>\n
  • 2019-03-23 vendor releases fixed version 2019.77 (commit 8b4f60a7a113f4e9ae801dea88606f2663728f03)<\/li>\n<\/ul>\n

    Credits<\/h3>\n

    This security vulnerability was found by Daniel Hoffmann of usd AG.<\/span><\/p>\n<\/div>\n<\/div>\n

    [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"

    usd-2018-0034 | Dropbear\/2011.54 up to 2019.77 Advisory ID: usd-2018-0034CVE-ID: CVE-2019-12953Affected Product: DropbearAffected Version: 2011.54 up to 2019.77Vulnerability Type: User EnumerationSecurity Risk: LowVendor URL: https:\/\/matt.ucc.asn.au\/dropbear\/dropbear.htmlVendor Status: Fixed Description Description based on commit 6f6ef4834c792f7ccf2409080a6adaf44b8f0d51 Dropbear does not crypt the password if the username is invalid. By sendinga long password, it is possible to measure time difference and […]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16587","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16587","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16587"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16587\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16587"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}