CVE-2017-9079: Medium severity Dropbear Ssh Project Dropbear Ssh vulnerability
Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorizedkeys file format with a command= option. This occurs because ~/.ssh/authorizedkeys is read with root privileges and symlinks are followed.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9079?
CVE-2017-9079 is considered to have a medium severity rating due to potential unauthorized access to sensitive files.
How do I fix CVE-2017-9079?
To fix CVE-2017-9079, upgrade Dropbear SSH to version 2017.75 or later.
Who is affected by CVE-2017-9079?
CVE-2017-9079 affects local users of Dropbear SSH versions prior to 2017.75 and users of Debian 8.0.
What vulnerabilities does CVE-2017-9079 introduce for local users?
CVE-2017-9079 allows local users to read certain files as root, which can lead to exposure of sensitive information.
What systems are vulnerable to CVE-2017-9079?
Systems running Dropbear SSH before version 2017.75 and Debian GNU/Linux 8.0 are vulnerable to CVE-2017-9079.