PT-2017-3173 · Dropbear+1 · Dropbear Ssh+1

Andrej Nemec · Publicado 2016-07-26 · Atualizado 2025-11-04 · CVE-2016-7406

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dropbear SSH versions prior to 2016.74

Description The issue is related to a format string vulnerability that allows remote attackers to execute arbitrary code. This is achieved by using format string specifiers in the username or host argument. The vulnerability exists due to insufficient input validation.

Recommendations For versions prior to 2016.74, update to version 2016.74 or later to resolve the issue. As a temporary workaround, consider restricting the use of format string specifiers in the username and host arguments until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2016-1786

BDU:2017-02587

CVE-2016-7406

DLA-634-1

MGASA-2016-0301

Produtos afetados

Alt Linux

Dropbear Ssh

Referências · 20

• https://osv.dev/vulnerability/DEBIAN-CVE-2016-7406 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-7406 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-7406 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/09/15/2 · Correção
• https://security.gentoo.org/glsa/201702-23 · Correção, Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/09/14/7 · Nota
• https://secure.ucc.asn.au/hg/dropbear/rev/10f28c95ca31 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=19074 · Nota
• https://advisories.mageia.org/MGASA-2016-0301.html · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2016-7406 · Aviso do Fabricante
• https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcb · Correção
• http://securityfocus.com/bid/92974 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1376353 · Nota
• http://seclists.org/fulldisclosure/2024/Aug/35 · Nota
• https://t.me/cveNotify/141601 · Publicação no Telegram