Unscored severity · published Dec 31, 2004
CVE-2004-2486
The DSS verification code in Dropbear SSH Server before 0.43 frees uninitialized variables, which might allow remote attackers to gain access
–
CVSS
3%
EPSS
No
On KEV
Description
The DSS verification code in Dropbear SSH Server before 0.43 frees uninitialized variables, which might allow remote attackers to gain access.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
Dropbear Ssh · Dropbear Ssh Project
before 0.43 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-2486
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-2486
Vendor Advisory
http://matt.ucc.asn.au/dropbear/CHANGES
Third Party Advisory
http://secunia.com/advisories/12153
Third Party Advisory
http://secunia.com/advisories/28935
Third Party Advisory
http://www.cisco.com/en/US/products/products_security_advisory09186a0080949c7a.shtml
Broken Link
http://www.osvdb.org/8137
Third Party Advisory
http://www.securityfocus.com/bid/10803
More from Dropbear Ssh
9.8
CVE-2016-7407
The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH key file
9.8
CVE-2016-7406
Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument
8.8
CVE-2017-9078
The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double free in cleanup of TCP listeners when the -a option is enabled
8.8
CVE-2016-7408
The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument
8.1
CVE-2020-36254
scp.c in Dropbear before 2020.79 mishandles the filename of