Scanning a machine on a local network (it is the only machine scanned, and is running Red Hat Enterprise Linux 7.4) and Nessus reports a vulnerability present in an outdated version of Dropbear SSH installed on the machine. The machine has OpenSSH but not dropbear. Here is the full text of the error:
Dropbear is an SSH client and server application. Versions of Dropbear SSH server prior to 2016.74.0 are potentially vulnerable to the following vulnerabilities :
A format string flaw exists that is triggered as string format specifiers (e.g. %s and %x) are not properly used when handling usernames or host arguments. This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-7406) - A flaw exists that is triggered during the handling of specially crafted OpenSSH key files that are imported via 'dropbearconvert'. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-7407) - A flaw exists in 'dbclient' that is triggered during the handling of '-m' or '-c' arguments, as used in scripts. This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-7408) - A flaw exists in 'dbclient' or 'dropbear server' that is triggered when compiling with 'DEBUG_TRACE' and running with '-v'. This may allow a local attacker to gain access to process memory. (CVE-2016-7409)
I have a suspicion that the error is a slight red herring and some other package on the system exposes one of the mentioned vulnerabilities, and the report persists after ensuring all installed packages are up to date. Can anyone shed any light on this and suggest a fix? It is possible that I do have dropbear or something that includes it as part of the RHEL distribution but cannot see it in the package list (using yum) nor is it present in the base RedHat repository.