CVE-2016-7406: Input Validation
Published Sep 15, 2016
·Updated
A new version of dropbear was released fixing multiple vulnerabilities.
References:
http://seclists.org/oss-sec/2016/q3/504
Other sources
Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.
— MITRE
Affected Software
2 affected componentsFixes available
redhat/dropbear<2016.74
2016.74
Dropbear Ssh Project Dropbear Ssh<=2016.73
Remediation
Patch Available
Patch Available
Patch Available
Event History
Mar 3, 2017
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Data Sourced
via NVD·04:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
Dec 13, 58332
Event
09:25 PM
Frequently Asked Questions
1
What is the severity of CVE-2016-7406?
CVE-2016-7406 is classified as a critical vulnerability due to its potential to allow remote code execution.
2
How do I fix CVE-2016-7406?
To fix CVE-2016-7406, update Dropbear SSH to version 2016.74 or higher.
3
What software is affected by CVE-2016-7406?
CVE-2016-7406 affects Dropbear SSH versions prior to 2016.74.
4
Can CVE-2016-7406 be exploited remotely?
Yes, CVE-2016-7406 can be exploited remotely by attackers via the format string vulnerability.
5
What is the impact of CVE-2016-7406?
The impact of CVE-2016-7406 could include unauthorized execution of arbitrary code on affected systems.