Dropbear: Privilege escalation

Dropbear: Privilege escalation A vulnerability has been found in Dropbear, which allows remote authenticated users to bypass intended shell-command restrictions. 2016-07-20 2016-07-20 577050 remote 2016.73 2016.73

Dropbear is a relatively small SSH server and client.

A CRLF injection vulnerability in Dropbear SSH allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.

A remote authenticated user could execute arbitrary code with the privileges of the process.

There is no known workaround at this time.

All Dropbear users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=net-misc/dropbear-2016.73"

CVE-2016-3116 b-man b-man