Dropbear SSH up to 2016 dbclient/server -v Memory information disclosure
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
4.2 | $0-$5k | 0.00 |
A vulnerability was found in Dropbear SSH up to 2016 (SSH Server Software). It has been classified as problematic. Affected is some unknown functionality of the component dbclient/server. The manipulation of the argument -v
with an unknown input leads to a information disclosure vulnerability (Memory). CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. CVE summarizes:
The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read process memory via the -v argument, related to a failed remote ident.
The bug was discovered 09/15/2016. The weakness was disclosed 03/03/2017 by Matt Johnston (oss-sec). The advisory is shared for download at openwall.com. This vulnerability is traded as CVE-2016-7409 since 09/09/2016. The attack needs to be approached locally. A authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.
The vulnerability was handled as a non-public zero-day exploit for at least 158 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 97266 (GLSA-201702-23 : Dropbear: Multiple vulnerabilities), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Gentoo Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 38670 (Dropbear SSH Multiple Security Vulnerabilities).
Upgrading to version 2016.74 eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.
The vulnerability is also documented in the vulnerability database at Tenable (97266). The entries 97509, 97510 and 97511 are pretty similar.
Product
Type
Name
Version
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.4VulDB Meta Temp Score: 4.3
VulDB Base Score: 3.3
VulDB Temp Score: 3.2
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 5.5
NVD Vector: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Name: MemoryClass: Information disclosure / Memory
CWE: CWE-200 / CWE-284 / CWE-266
CAPEC: 🔍
ATT&CK: 🔍
Local: Yes
Remote: No
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Nessus ID: 97266
Nessus Name: GLSA-201702-23 : Dropbear: Multiple vulnerabilities
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Nessus Context: 🔍
OpenVAS ID: 803656
OpenVAS Name: Dropbear SSH Multiple Vulnerabilities
OpenVAS File: 🔍
OpenVAS Family: 🔍
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: Dropbear SSH 2016.74
Timeline
09/09/2016 🔍09/14/2016 🔍
09/15/2016 🔍
02/20/2017 🔍
02/21/2017 🔍
03/03/2017 🔍
03/03/2017 🔍
03/04/2017 🔍
09/03/2020 🔍
Sources
Advisory: openwall.comResearcher: Matt Johnston
Status: Not defined
Confirmation: 🔍
CVE: CVE-2016-7409 (🔍)
SecurityFocus: 92973 - Dropbear SSH CVE-2016-7409 Information Disclosure Vulnerability
OSVDB: - CVE-2016-7409 - Dropbear SSH - Information Disclosure Issue
See also: 🔍
Entry
Created: 03/04/2017 13:46Updated: 09/03/2020 18:54
Changes: 03/04/2017 13:46 (81), 09/03/2020 18:54 (3)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.