oss-security - CVE request for Dropbear SSH <2016.74

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160914115904.GD17345@ucc.gu.uwa.edu.au>
Date: Wed, 14 Sep 2016 19:59:04 +0800
From: Matt Johnston <matt@....asn.au>
To: oss-security@...ts.openwall.com
Subject: CVE request for Dropbear SSH <2016.74

Hi,

Dropbear 2016.74 fixed security issues, can I please have 5
CVEs assigned. The first one has different exposure for
client/server parts so I assume it should have separate
CVEs?

Cheers,
Matt
(please CC replies)

2016.74 - 21 July 2016

- Security: Message printout was vulnerable to format string injection.

  If specific usernames including "%" symbols can be created on a system
  (validated by getpwnam()) then an attacker could run arbitrary code as root
  when connecting to Dropbear server.

  A dbclient user who can control username or host arguments could potentially
  run arbitrary code as the dbclient user. This could be a problem if scripts
  or webpages pass untrusted input to the dbclient program.
  https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcb

- Security: dropbearconvert import of OpenSSH keys could run arbitrary code as
  the local dropbearconvert user when parsing malicious key files
  https://secure.ucc.asn.au/hg/dropbear/rev/34e6127ef02e

- Security: dbclient could run arbitrary code as the local dbclient user if
  particular -m or -c arguments are provided. This could be an issue where
  dbclient is used in scripts.
  https://secure.ucc.asn.au/hg/dropbear/rev/eed9376a4ad6

- Security: dbclient or dropbear server could expose process memory to the
  running user if compiled with DEBUG_TRACE and running with -v
  https://secure.ucc.asn.au/hg/dropbear/rev/6a14b1f6dc04

  The security issues were reported by an anonymous researcher working with
  Beyond Security's SecuriTeam Secure Disclosure www.beyondsecurity.com/ssd.html

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.