Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary     code via format string specifiers in the (1) username or (2) host argument. (CVE-2016-7406)

Note that Nessus relies on the presence of the package as reported by the vendor.

Dropbear is an SSH client and server application.  Versions of Dropbear SSH server prior to 2016.74.0 are potentially vulnerable to the following vulnerabilities :

 - A format string flaw exists that is triggered as string format specifiers (e.g. %s and %x) are not properly used when handling usernames or host arguments.  This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-7406)
 - A flaw exists that is triggered during the handling of specially crafted OpenSSH key files that are imported via 'dropbearconvert'.  This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-7407)
 - A flaw exists in 'dbclient' that is triggered during the handling of '-m' or '-c' arguments, as used in scripts.  This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-7408)
 - A flaw exists in 'dbclient' or 'dropbear server' that is triggered when compiling with 'DEBUG_TRACE' and running with '-v'.  This may allow a local attacker to gain access to process memory. (CVE-2016-7409)

The remote host is affected by the vulnerability described in GLSA-201702-23 (Dropbear: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Dropbear. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with root       privileges if usernames containing special characters can be created on a       system. Also, a dbclient user who can control username or host arguments       could potentially run arbitrary code with the privileges of the process.
    In addition, a remote attacker could entice a user to process a       specially crafted SSH key using dropbearconvert, possibly resulting in       execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

According to its self-reported version in its banner, Dropbear SSH running on the remote host is prior to 2016.74. It is, therefore, affected by the following vulnerabilities :

  - A format string flaw exists due to improper handling of     string format specifiers (e.g., %s and %x) in usernames     and host arguments. An unauthenticated, remote attacker     can exploit this to execute arbitrary code with root     privileges. (CVE-2016-7406)

  - A flaw exists in dropbearconvert due to improper     handling of specially crafted OpenSSH key files. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2016-7407)

  - A flaw exists in dbclient when handling the -m or -c     arguments in scripts. An unauthenticated, remote attacker     can exploit this, via a specially crafted script, to     execute arbitrary code. (CVE-2016-7408)

  - A flaw exists in dbclient or dropbear server if they are     compiled with the DEBUG_TRACE option and then run using     the -v switch. A local attacker can exploit this to     disclose process memory. (CVE-2016-7409)

Matt Johnston reports :

If specific usernames including '%' symbols can be created on a system (validated by getpwnam()) then an attacker could run arbitrary code as root when connecting to Dropbear server.

A dbclient user who can control username or host arguments could potentially run arbitrary code as the dbclient user. This could be a problem if scripts or webpages pass untrusted input to the dbclient program.

dropbearconvert import of OpenSSH keys could run arbitrary code as the local dropbearconvert user when parsing malicious key files.

dbclient could run arbitrary code as the local dbclient user if particular -m or -c arguments are provided. This could be an issue where dbclient is used in scripts.

dbclient or dropbear server could expose process memory to the running user if compiled with DEBUG_TRACE and running with -v

ID	Name	Product	Family	Severity
251911	Linux Distros Unpatched Vulnerability : CVE-2016-7406	Nessus	Misc.	critical
700028	Dropbear SSH < 2016.74.0 Multiple Vulnerabilities	Nessus Network Monitor	SSH	critical
97266	GLSA-201702-23 : Dropbear: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
93650	Dropbear SSH Server < 2016.72 Multiple Vulnerabilities	Nessus	Misc.	critical
93552	FreeBSD : dropbear -- multiple vulnerabilities (bc19dcca-7b13-11e6-b99e-589cfc0654e1)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2016-7406

critical

Tenable Plugins

critical

critical

critical

critical

critical