38 lines
881 B
YAML
38 lines
881 B
YAML
id: dropbear-weakmac
|
|
|
|
info:
|
|
name: Dropbear Weak MAC Algorithms Enabled
|
|
author: pussycat0x
|
|
severity: low
|
|
description: |
|
|
The mac-alg command specifies which MAC algorithms in the SSH client profile for SSH encryption negotiation with an SFTP server when the DataPower Gateway acts as an SFTP client.
|
|
remediation: |
|
|
Disable MD5 and 96-bit MAC algorithms.
|
|
reference: |
|
|
https://www.virtuesecurity.com/kb/ssh-weak-mac-algorithms-enabled
|
|
metadata:
|
|
max-request: 2
|
|
verified: true
|
|
shodan-query: 'product:"Dropbear sshd"'
|
|
tags: network,ssh,dropbear,misconfig
|
|
|
|
tcp:
|
|
- inputs:
|
|
- data: "\n"
|
|
|
|
host:
|
|
- "{{Hostname}}"
|
|
- "{{Host}}:22"
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- "hmac-md5"
|
|
- "hmac-sha1"
|
|
condition: or
|
|
|
|
- type: word
|
|
words:
|
|
- "SSH-"
|