Advisories » MGASA-2016-0301

Updated dropbear packages fix security vulnerability

Publication date: 16 Sep 2016
Modification date: 15 Sep 2016
Type: security
Affected Mageia releases : 5
CVE: CVE-2016-7406 , CVE-2016-7407 , CVE-2016-7408

Description

Message printout was vulnerable to format string injection.

If specific usernames including "%" symbols can be created on a system
(validated by getpwnam()) then an attacker could run arbitrary code as
root when connecting to Dropbear server. Also, a dbclient user who can
control username or host arguments could potentially run arbitrary code
as the dbclient user. This could be a problem if scripts or webpages
pass untrusted input to the dbclient program (CVE-2016-7406).

dropbearconvert import of OpenSSH keys could run arbitrary code as the
local dropbearconvert user when parsing malicious key files
(CVE-2016-7607).

dbclient could run arbitrary code as the local dbclient user if
particular -m or -c arguments are provided. This could be an issue where
dbclient is used in scripts (CVE-2016-7408).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=19074
• http://www.openwall.com/lists/oss-security/2016/09/15/2
• https://secure.ucc.asn.au/hg/dropbear/rev/10f28c95ca31
• https://www.cve.org/CVERecord?id=CVE-2016-7406
• https://www.cve.org/CVERecord?id=CVE-2016-7407
• https://www.cve.org/CVERecord?id=CVE-2016-7408

SRPMS

5/core

• dropbear-2014.66-1.2.mga5