CVE-2017-9078: Dropbear 2017.75

Matt Johnston matt at ucc.asn.au
Thu May 18 23:02:09 AWST 2017

• Previous message: Errorcodes
• Next message: Dropbear 2017.75
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi all,

Dropbear 2017.75 is released. This has a couple of security fixes and a couple of bug fixes since 2016.74.

https://matt.ucc.asn.au/dropbear/dropbear.html

I’m intending to make another release in the next couple of weeks including the various pending fixes in the Mercurial tree and pull requests. That’s a bit more obtrusive with changes to options.h and #ifdef => #if.

Cheers, Matt

2017.75 - 18 May 2017

• Security: Fix double-free in server TCP listener cleanup A double-free in the server could be triggered by an authenticated user if dropbear is running with -a (Allow connections to forwarded ports from any host) This could potentially allow arbitrary code execution as root by an authenticated user. Affects versions 2013.56 to 2016.74. Thanks to Mark Shepard for reporting the crash.

• Security: Fix information disclosure with ~/.ssh/authorized_keys symlink. Dropbear parsed authorized_keys as root, even if it were a symlink. The fix is to switch to user permissions when opening authorized_keys

  A user could symlink their ~/.ssh/authorized_keys to a root-owned file they couldn’t normally read. If they managed to get that file to contain valid authorized_keys with command= options it might be possible to read other contents of that file. This information disclosure is to an already authenticated user. Thanks to Jann Horn of Google Project Zero for reporting this.

• Generate hostkeys with dropbearkey atomically and flush to disk with fsync Thanks to Andrei Gherzan for a patch

• Fix out of tree builds with bundled libtom Thanks to Henrik Nordström and Peter Krefting for patches.

• Previous message: Errorcodes
• Next message: Dropbear 2017.75
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

More information about the Dropbear mailing list