CVE-2016-3116 : CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-c

CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.

Published 2016-03-22 10:59:04

Updated 2016-12-03 03:26:26

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2016-3116

Dropbear Ssh Project » Dropbear Ssh
Versions up to, including, (<=) 2015.71
cpe:2.3:a:dropbear_ssh_project:dropbear_ssh:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2016-3116

EPSS FAQ

2.84%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 90 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-3116

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:N	8.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
6.4	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	3.1	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: Low Integrity: Low Availability: None

References for CVE-2016-3116

http://packetstormsecurity.com/files/136251/Dropbear-SSHD-xauth-Command-Injection-Bypass.html

Dropbear SSHD xauth Command Injection / Bypass ≈ Packet Storm
http://lists.opensuse.org/opensuse-updates/2016-03/msg00105.html

openSUSE-SU-2016:0874-1: moderate: Security update for dropbear
https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115

pub/pocs/cve-2016-3115 at master · tintinweb/pub · GitHub

CVEs referencing this url
https://security.gentoo.org/glsa/201607-08

Dropbear: Privilege escalation (GLSA 201607-08) — Gentoo security
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179870.html

[SECURITY] Fedora 24 Update: dropbear-2016.72-1.fc24
https://matt.ucc.asn.au/dropbear/CHANGES

CVEs referencing this url
http://lists.opensuse.org/opensuse-updates/2016-03/msg00113.html

openSUSE-SU-2016:0882-1: moderate: Security update for dropbear
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179269.html

[SECURITY] Fedora 22 Update: dropbear-2016.72-1.fc22
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179261.html

[SECURITY] Fedora 23 Update: dropbear-2016.72-1.fc23
http://seclists.org/fulldisclosure/2016/Mar/47

Full Disclosure: CVE-2016-3116 - Dropbear SSH xauth injection

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2016-3116

Products affected by CVE-2016-3116

Exploit prediction scoring system (EPSS) score for CVE-2016-3116

CVSS scores for CVE-2016-3116

References for CVE-2016-3116