aboutsummaryrefslogtreecommitdiffstats
path: root/package
diff options
context:
space:
mode:
authorJo-Philipp Wich <jo@mein.io>2016-08-12 11:44:07 +0200
committerJo-Philipp Wich <jo@mein.io>2016-08-12 11:45:47 +0200
commit4e8c6f340751c66a602b98b727af28b2a9004313 (patch)
tree076a4137b57684fdd79b01205f380c336cee4c48 /package
parentf76f83de7117a1a5b3732b97fc8cbe7d73680e9e (diff)
downloadupstream-4e8c6f340751c66a602b98b727af28b2a9004313.tar.gz
upstream-4e8c6f340751c66a602b98b727af28b2a9004313.tar.bz2
upstream-4e8c6f340751c66a602b98b727af28b2a9004313.zip
dropbear: security update to 2016.74
- Security: Message printout was vulnerable to format string injection. If specific usernames including "%" symbols can be created on a system (validated by getpwnam()) then an attacker could run arbitrary code as root when connecting to Dropbear server. A dbclient user who can control username or host arguments could potentially run arbitrary code as the dbclient user. This could be a problem if scripts or webpages pass untrusted input to the dbclient program. - Security: dropbearconvert import of OpenSSH keys could run arbitrary code as the local dropbearconvert user when parsing malicious key files - Security: dbclient could run arbitrary code as the local dbclient user if particular -m or -c arguments are provided. This could be an issue where dbclient is used in scripts. - Security: dbclient or dropbear server could expose process memory to the running user if compiled with DEBUG_TRACE and running with -v The security issues were reported by an anonymous researcher working with Beyond Security's SecuriTeam Secure Disclosure www.beyondsecurity.com/ssd.html Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Diffstat (limited to 'package')
-rw-r--r--package/network/services/dropbear/Makefile4
1 files changed, 2 insertions, 2 deletions
diff --git a/package/network/services/dropbear/Makefile b/package/network/services/dropbear/Makefile
index 9d62e926b4..36bcb4ab7b 100644
--- a/package/network/services/dropbear/Makefile
+++ b/package/network/services/dropbear/Makefile
@@ -8,14 +8,14 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=dropbear
-PKG_VERSION:=2016.73
+PKG_VERSION:=2016.74
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:= \
http://matt.ucc.asn.au/dropbear/releases/ \
https://dropbear.nl/mirror/releases/
-PKG_MD5SUM:=8d6d78ce60ca52350ec04fcbd711ce9b
+PKG_MD5SUM:=9ad0172731e0f16623937804643b5bd8
PKG_LICENSE:=MIT
PKG_LICENSE_FILES:=LICENSE libtomcrypt/LICENSE libtommath/LICENSE