CVE-2016-3116
published 2016-03-22CVE-2016-3116: CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11…
PriorityP351medium6.4CVSS 3.0
AVNACLPRLUINSCCLILAN
EXPLOIT
EPSS
19.30%
97.0th percentile
CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | dropbear | < dropbear 2016.72-1 (bookworm) | dropbear 2016.72-1 (bookworm) |
| dropbear_ssh_project | dropbear_ssh | <= 2015.71 | — |
| dropbear_ssh_project | dropbear_ssh | >= 0 < 2016.72-1 | 2016.72-1 |
| dropbear_ssh_project | dropbear_ssh | >= 0 < 2016.72-1 | 2016.72-1 |
| dropbear_ssh_project | dropbear_ssh | >= 0 < 2016.72-1 | 2016.72-1 |
| dropbear_ssh_project | dropbear_ssh | >= 0 < 2016.72-1 | 2016.72-1 |
CVSS provenance
nvdv3.06.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
osv6.4MEDIUM
vendor_debian6.4MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qrcr-w7v9-jxvw: CRLF injection vulnerability in Dropbear SSH before 2016
ghsa_unreviewed·2022-05-17
CVE-2016-3116 [MEDIUM] GHSA-qrcr-w7v9-jxvw: CRLF injection vulnerability in Dropbear SSH before 2016
CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.
OSV
CVE-2016-3116: CRLF injection vulnerability in Dropbear SSH before 2016
osv·2016-03-22·CVSS 6.4
CVE-2016-3116 [MEDIUM] CVE-2016-3116: CRLF injection vulnerability in Dropbear SSH before 2016
CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.
Debian
CVE-2016-3116: dropbear - CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authen...
vendor_debian·2016·CVSS 6.4
CVE-2016-3116 [MEDIUM] CVE-2016-3116: dropbear - CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authen...
CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.
Scope: local
bookworm: resolved (fixed in 2016.72-1)
bullseye: resolved (fixed in 2016.72-1)
forky: resolved (fixed in 2016.72-1)
sid: resolved (fixed in 2016.72-1)
trixie: resolved (fixed in 2016.72-1)
No detection rules found.
Bugzilla
CVE-2016-3116 dropbear: X11 forwarding input not validated properly [fedora-all]
bugzilla·2016-03-11·CVSS 6.4
CVE-2016-3116 [MEDIUM] CVE-2016-3116 dropbear: X11 forwarding input not validated properly [fedora-all]
CVE-2016-3116 dropbear: X11 forwarding input not validated properly [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions
Bugzilla
CVE-2016-3116 dropbear: X11 forwarding input not validated properly
bugzilla·2016-03-11·CVSS 6.4
CVE-2016-3116 [MEDIUM] CVE-2016-3116 dropbear: X11 forwarding input not validated properly
CVE-2016-3116 dropbear: X11 forwarding input not validated properly
A vulnerability was found in a way dropbear processed X11 forwarding input. By using a specially crafted request, an attacker could bypass the authorized_keys command restrictions.
External references:
https://matt.ucc.asn.au/dropbear/CHANGES
CVE assignment:
http://seclists.org/oss-sec/2016/q1/593
Discussion:
Created dropbear tracking bugs for this issue:
Affects: fedora-all [bug 1316826]
Affects: epel-all [bug 1316827]
---
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.
Bugzilla
CVE-2016-3116 dropbear: X11 forwarding input not validated properly [epel-all]
bugzilla·2016-03-11·CVSS 6.4
CVE-2016-3116 [MEDIUM] CVE-2016-3116 dropbear: X11 forwarding input not validated properly [epel-all]
CVE-2016-3116 dropbear: X11 forwarding input not validated properly [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versio
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179261.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/179269.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/179870.htmlhttp://lists.opensuse.org/opensuse-updates/2016-03/msg00105.htmlhttp://lists.opensuse.org/opensuse-updates/2016-03/msg00113.htmlhttp://packetstormsecurity.com/files/136251/Dropbear-SSHD-xauth-Command-Injection-Bypass.htmlhttp://seclists.org/fulldisclosure/2016/Mar/47https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115https://matt.ucc.asn.au/dropbear/CHANGEShttps://security.gentoo.org/glsa/201607-08http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179261.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/179269.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/179870.htmlhttp://lists.opensuse.org/opensuse-updates/2016-03/msg00105.htmlhttp://lists.opensuse.org/opensuse-updates/2016-03/msg00113.htmlhttp://packetstormsecurity.com/files/136251/Dropbear-SSHD-xauth-Command-Injection-Bypass.htmlhttp://seclists.org/fulldisclosure/2016/Mar/47https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115https://matt.ucc.asn.au/dropbear/CHANGEShttps://security.gentoo.org/glsa/201607-08
2016-03-22
Published