Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 14 Sep 2016 19:59:04 +0800
From: Matt Johnston <matt@....asn.au>
To: oss-security@...ts.openwall.com
Subject: CVE request for Dropbear SSH <2016.74

Hi,

Dropbear 2016.74 fixed security issues, can I please have 5
CVEs assigned. The first one has different exposure for
client/server parts so I assume it should have separate
CVEs?

Cheers,
Matt
(please CC replies)

2016.74 - 21 July 2016

- Security: Message printout was vulnerable to format string injection.

  If specific usernames including "%" symbols can be created on a system
  (validated by getpwnam()) then an attacker could run arbitrary code as root
  when connecting to Dropbear server.

  A dbclient user who can control username or host arguments could potentially
  run arbitrary code as the dbclient user. This could be a problem if scripts
  or webpages pass untrusted input to the dbclient program.
  https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcb

- Security: dropbearconvert import of OpenSSH keys could run arbitrary code as
  the local dropbearconvert user when parsing malicious key files
  https://secure.ucc.asn.au/hg/dropbear/rev/34e6127ef02e

- Security: dbclient could run arbitrary code as the local dbclient user if
  particular -m or -c arguments are provided. This could be an issue where
  dbclient is used in scripts.
  https://secure.ucc.asn.au/hg/dropbear/rev/eed9376a4ad6

- Security: dbclient or dropbear server could expose process memory to the
  running user if compiled with DEBUG_TRACE and running with -v
  https://secure.ucc.asn.au/hg/dropbear/rev/6a14b1f6dc04

  The security issues were reported by an anonymous researcher working with
  Beyond Security's SecuriTeam Secure Disclosure www.beyondsecurity.com/ssd.html

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ