CVE-2017-9079 — Incorrect Permission Assignment in SSH Project Dropbear SSH

CWE-732 — Incorrect Permission Assignment8 documents6 sources
Severity
4.7MEDIUMNVD
EPSS
0.1%
top 75.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Dropbear SSH Project Dropbear SSHDebian DropbearDebian Linux
Timeline
PublishedMay 19
Latest updateMay 13

Description

Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occurs because ~/.ssh/authorized_keys is read with root privileges and symlinks are followed.

CVSS vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.0 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/dropbear< dropbear 2016.74-5 (bookworm)
▶Debiandropbear_ssh_project/dropbear_ssh< 2016.74-5+3

Also affects: Debian Linux 8.0

Patches

Patch: lists.ucc.gu.uwa.edu.au ↗Patch: lists.ucc.gu.uwa.edu.au ↗

🔴Vulnerability Details

2
GHSA
GHSA-j5rr-cpp9-c4r6: Dropbear before 2017↗2022-05-13
▶
OSV
CVE-2017-9079: Dropbear before 2017↗2017-05-19
▶

📋Vendor Advisories

1
Debian
CVE-2017-9079: dropbear - Dropbear before 2017.75 might allow local users to read certain files as root, i...↗2017
▶

💬Community

3
Bugzilla
CVE-2017-9078 CVE-2017-9079 dropbear: Multiple vulnerabilities fixed in 2017.75 version↗2017-05-19
▶
Bugzilla
CVE-2017-9078 CVE-2017-9079 dropbear: Multiple vulnerabilities fixed in 2017.75 version [fedora-all]↗2017-05-19
▶
Bugzilla
CVE-2017-9078 CVE-2017-9079 dropbear: Multiple vulnerabilities fixed in 2017.75 version [epel-all]↗2017-05-19
▶