CVE-2016-3116: CRLF Injection
Published Mar 22, 2016
·Updated
CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.
Affected Software
1 affected component
Dropbear Ssh Project Dropbear Ssh<=2015.71
Event History
Mar 22, 2016
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-3116?
CVE-2016-3116 has a medium severity rating due to its potential for remote authenticated users to execute unauthorized commands.
2
How do I fix CVE-2016-3116?
To fix CVE-2016-3116, upgrade Dropbear SSH to version 2016.72 or later.
3
Who is affected by CVE-2016-3116?
CVE-2016-3116 affects Dropbear SSH versions prior to 2016.72 used by remote authenticated users.
4
What type of vulnerability is CVE-2016-3116?
CVE-2016-3116 is a CRLF injection vulnerability that allows command bypass.
5
What is the impact of CVE-2016-3116?
The impact of CVE-2016-3116 includes the potential for remote authenticated users to circumvent shell-command restrictions.