Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occurs because ~/.ssh/authorized_keys is read with root privileges and symlinks are followed.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the     authorized_keys file format with a command= option. This occurs because ~/.ssh/authorized_keys is read     with root privileges and symlinks are followed. (CVE-2017-9079)

Note that Nessus relies on the presence of the package as reported by the vendor.

Security fixes for CVE-2017-9078 CVE-2017-9079

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Matt Johnston reports :

Fix double-free in server TCP listener cleanup A double-free in the server could be triggered by an authenticated user if dropbear is running with -a (Allow connections to forwarded ports from any host) This could potentially allow arbitrary code execution as root by an authenticated user.

Fix information disclosure with ~/.ssh/authorized_keys symlink.
Dropbear parsed authorized_keys as root, even if it were a symlink.
The fix is to switch to user permissions when opening authorized_keys.

Two vulnerabilities were found in Dropbear, a lightweight SSH2 server and client :

  - CVE-2017-9078     Mark Shepard discovered a double free in the TCP     listener cleanup which could result in denial of service     by an authenticated user if Dropbear is running with the     '-a' option.

  - CVE-2017-9079     Jann Horn discovered a local information leak in parsing     the .authorized_keys file.

A vulnerability was found in Dropbear, a lightweight SSH2 server and client.

CVE-2017-9079

Jann Horn discovered a local information leak in parsing the .authorized_keys file.

For Debian 7 'Wheezy', this problem has been fixed in version 2012.55-1.3+deb7u2.

We recommend that you upgrade your dropbear packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
251913	Linux Distros Unpatched Vulnerability : CVE-2017-9079	Nessus	Misc.	medium
101694	Fedora 26 : dropbear (2017-a50319c820)	Nessus	Fedora Local Security Checks	high
101217	FreeBSD : Dropbear -- two vulnerabilities (60931f98-55a7-11e7-8514-589cfc0654e1)	Nessus	FreeBSD Local Security Checks	high
100608	Fedora 24 : dropbear (2017-b22de5c767)	Nessus	Fedora Local Security Checks	high
100607	Fedora 25 : dropbear (2017-8e9bd58cbb)	Nessus	Fedora Local Security Checks	high
100306	Debian DSA-3859-1 : dropbear - security update	Nessus	Debian Local Security Checks	high
100304	Debian DLA-948-1 : dropbear security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2017-9079

medium

Tenable Plugins

medium

high

high

high

high

high

medium