Nessus scan reports a Dropbear vulnerability on a machine that does not have dropbear installed

Question

Scanning a machine on a local network (it is the only machine scanned, and is running Red Hat Enterprise Linux 7.4) and Nessus reports a vulnerability present in an outdated version of Dropbear SSH installed on the machine. The machine has OpenSSH but not dropbear. Here is the full text of the error:

Dropbear is an SSH client and server application. Versions of Dropbear SSH server prior to 2016.74.0 are potentially vulnerable to the following vulnerabilities :

A format string flaw exists that is triggered as string format specifiers (e.g. %s and %x) are not properly used when handling usernames or host arguments. This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-7406) - A flaw exists that is triggered during the handling of specially crafted OpenSSH key files that are imported via 'dropbearconvert'. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-7407) - A flaw exists in 'dbclient' that is triggered during the handling of '-m' or '-c' arguments, as used in scripts. This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-7408) - A flaw exists in 'dbclient' or 'dropbear server' that is triggered when compiling with 'DEBUG_TRACE' and running with '-v'. This may allow a local attacker to gain access to process memory. (CVE-2016-7409)

I have a suspicion that the error is a slight red herring and some other package on the system exposes one of the mentioned vulnerabilities, and the report persists after ensuring all installed packages are up to date. Can anyone shed any light on this and suggest a fix? It is possible that I do have dropbear or something that includes it as part of the RHEL distribution but cannot see it in the package list (using yum) nor is it present in the base RedHat repository.

Answer 1

To help anyone who comes across this with a similar issue:

After attempting to SSH to the machine being scanned with putty, it was clear that the machine refused SSH access due to sshd_config not allowing root access.

The putty event log showed that the server was reporting an outdated dropbear version in the banner message, which is what caused the scanner to raise this error.

You can double check that the scan did actually successfully connect to the machine by checking plugin 19506 and verifying that 'Credentialed checks' reports a success. Also check that the machine you are attempting to connect to is properly configured and allows SSH connections.