Security flaws in dropbear prior to v2016.74

[Mark Foster]

Affected LTS versions:
 Precise 2011.54-1ubuntu0.12.04.1
 Trusty 2013.60-1ubuntu2.1
 Xenial 2016.72-1

Ref: https://matt.ucc.asn.au/dropbear/CHANGES

2016.74 - 21 July 2016

- Security: Message printout was vulnerable to format string injection.

  If specific usernames including "%" symbols can be created on a system
  (validated by getpwnam()) then an attacker could run arbitrary code as root
  when connecting to Dropbear server.

  A dbclient user who can control username or host arguments could potentially
  run arbitrary code as the dbclient user. This could be a problem if scripts
  or webpages pass untrusted input to the dbclient program.
  CVE-2016-7406
  https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcb

- Security: dropbearconvert import of OpenSSH keys could run arbitrary code as
  the local dropbearconvert user when parsing malicious key files
  CVE-2016-7407
  https://secure.ucc.asn.au/hg/dropbear/rev/34e6127ef02e

- Security: dbclient could run arbitrary code as the local dbclient user if
  particular -m or -c arguments are provided. This could be an issue where
  dbclient is used in scripts.
  CVE-2016-7408
  https://secure.ucc.asn.au/hg/dropbear/rev/eed9376a4ad6

- Security: dbclient or dropbear server could expose process memory to the
  running user if compiled with DEBUG_TRACE and running with -v
  CVE-2016-7409
  https://secure.ucc.asn.au/hg/dropbear/rev/6a14b1f6dc04

  The security issues were reported by an anonymous researcher working with
  Beyond Security's SecuriTeam Secure Disclosure www.beyondsecurity.com/ssd.html

- Fix port forwarding failure when connecting to domains that have both
  IPv4 and IPv6 addresses. The bug was introduced in 2015.68

- Fix 100% CPU use while waiting for rekey to complete. Thanks to Zhang Hui P
  for the patch

2016.73 - 18 March 2016

- Support syslog in dbclient, option -o usesyslog=yes. Patch from Konstantin Tokarev

- Kill a proxycommand when dbclient exits, patch from Konstantin Tokarev

- Option to exit when a TCP forward fails, patch from Konstantin Tokarev

- New "-o" option parsing from Konstantin Tokarev. This allows handling some extra options
  in the style of OpenSSH, though implementing all OpenSSH options is not planned.

- Fix crash when fallback initshells() is used, reported by Michael Nowak and Mike Tzou

- Allow specifying commands eg "dropbearmulti dbclient ..." instead of symlinks

- Various cleanups for issues found by a lint tool, patch from Francois Perrad

- Fix tab indent consistency, patch from Francois Perrad

- Fix issues found by cppcheck, reported by Mike Tzou

- Use system memset_s() or explicit_bzero() if available to clear memory. Also make
  libtomcrypt/libtommath routines use that (or Dropbear's own m_burn()).

- Prevent scp failing when the local user doesn't exist. Based on patch from Michael Witten.

- Improved Travis CI test running, thanks to Mike Tzou

- Improve some code that was flagged by Coverity and Fortify Static Code Analyzer

...

[Tyler Hicks (tyhicks)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Launchpad Janitor (janitor)]

[Expired for dropbear (Ubuntu) because there has been no activity for 60 days.]