Critical severity · published Mar 3, 2017
CVE-2016-7406
Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument
9.8
CVSS
10.2%
EPSS
No
On KEV
Description
Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)10.2% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
Dropbear Ssh · Dropbear Ssh Project
through 2016.73 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-7406
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-7406
Mailing List
http://www.openwall.com/lists/oss-security/2016/09/15/2
Third Party Advisory
http://www.securityfocus.com/bid/92974
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1376353
Issue Tracking
https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcb
Patch
https://security.gentoo.org/glsa/201702-23
seclists.org
http://seclists.org/fulldisclosure/2024/Aug/35
More from Dropbear Ssh
9.8
CVE-2016-7407
The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH key file
8.8
CVE-2017-9078
The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double free in cleanup of TCP listeners when the -a option is enabled
8.8
CVE-2016-7408
The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument
8.1
CVE-2020-36254
scp.c in Dropbear before 2020.79 mishandles the filename of
7.5
CVE-2021-36369
An issue was discovered in Dropbear through 2020.81