PT-2017-3173 · Dropbear+1 · Dropbear Ssh+1

Andrej Nemec · Published 2016-07-26 · Updated 2025-11-04 · CVE-2016-7406

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dropbear SSH versions prior to 2016.74

Description The issue is related to a format string vulnerability that allows remote attackers to execute arbitrary code. This is achieved by using format string specifiers in the username or host argument. The vulnerability exists due to insufficient input validation.

Recommendations For versions prior to 2016.74, update to version 2016.74 or later to resolve the issue. As a temporary workaround, consider restricting the use of format string specifiers in the username and host arguments until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2016-1786

BDU:2017-02587

CVE-2016-7406

DLA-634-1

MGASA-2016-0301

Affected Products

Alt Linux

Dropbear Ssh

References · 20

• https://osv.dev/vulnerability/DEBIAN-CVE-2016-7406 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-7406 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7406 · Vendor Advisory
• http://openwall.com/lists/oss-security/2016/09/15/2 · Patch
• https://advisories.mageia.org/MGASA-2016-0301.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-7406 · Vendor Advisory
• https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcb · Patch
• https://cve.org/CVERecord?id=CVE-2016-7406 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-7406 · Security Note
• https://bdu.fstec.ru/vul/2017-02587 · Security Note
• https://osv.dev/vulnerability/MGASA-2016-0301 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-7406 · Vendor Advisory
• https://security.gentoo.org/glsa/201702-23 · Patch, Vendor Advisory
• http://openwall.com/lists/oss-security/2016/09/14/7 · Note
• https://secure.ucc.asn.au/hg/dropbear/rev/10f28c95ca31 · Note