diff options
author | Jo-Philipp Wich <jo@mein.io> | 2016-08-12 11:44:07 +0200 |
---|---|---|
committer | Jo-Philipp Wich <jo@mein.io> | 2016-08-12 11:45:47 +0200 |
commit | 4e8c6f340751c66a602b98b727af28b2a9004313 (patch) | |
tree | 076a4137b57684fdd79b01205f380c336cee4c48 /include/package-ipkg.mk | |
parent | f76f83de7117a1a5b3732b97fc8cbe7d73680e9e (diff) | |
download | upstream-4e8c6f340751c66a602b98b727af28b2a9004313.tar.gz upstream-4e8c6f340751c66a602b98b727af28b2a9004313.tar.bz2 upstream-4e8c6f340751c66a602b98b727af28b2a9004313.zip |
dropbear: security update to 2016.74
- Security: Message printout was vulnerable to format string injection.
If specific usernames including "%" symbols can be created on a system
(validated by getpwnam()) then an attacker could run arbitrary code as root
when connecting to Dropbear server.
A dbclient user who can control username or host arguments could potentially
run arbitrary code as the dbclient user. This could be a problem if scripts
or webpages pass untrusted input to the dbclient program.
- Security: dropbearconvert import of OpenSSH keys could run arbitrary code as
the local dropbearconvert user when parsing malicious key files
- Security: dbclient could run arbitrary code as the local dbclient user if
particular -m or -c arguments are provided. This could be an issue where
dbclient is used in scripts.
- Security: dbclient or dropbear server could expose process memory to the
running user if compiled with DEBUG_TRACE and running with -v
The security issues were reported by an anonymous researcher working with
Beyond Security's SecuriTeam Secure Disclosure www.beyondsecurity.com/ssd.html
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Diffstat (limited to 'include/package-ipkg.mk')
0 files changed, 0 insertions, 0 deletions