CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.

Dropbear is an SSH client and server application.  Versions of Dropbear SSH server prior to 2016.72.0 are potentially vulnerable to a flaw when X11Forwarding is enabled that is due to the system failing to sanitize X11 authentication credentials.  This may allow an authenticated remote attacker to inject arbitrary xauth commands.

new version

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201607-08 (Dropbear: Privilege escalation)

    A CRLF injection vulnerability in Dropbear SSH allows remote       authenticated users to bypass intended shell-command restrictions via       crafted X11 forwarding data.
  Impact :

    A remote authenticated user could execute arbitrary code with the       privileges of the process.
  Workaround :

    There is no known workaround at this time.

CVE-2016-3116 dropbear: X11 forwarding input not validated properly

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dropbear fixes the following issues :

  - dropbear was updated to upstream version 2016.72

  - Validate X11 forwarding input. Could allow bypass of     authorized_keys command= restrictions, found by     github.com/tintinweb. Thanks for Damien Miller for a     patch.

  - used as bug fix release for boo#970633 - CVE-2016-3116

  - dropbear was updated to upstream version 2015.71

  - Fix 'bad buf_incrpos' when data is transferred, broke in     2015.69

  - Fix crash on exit when -p address:port is used, broke in     2015.68

  - Fix building with only ENABLE_CLI_REMOTETCPFWD given,     patch from Konstantin Tokarev

  - Fix bad configure script test which didn't work with     dash shell, patch from Juergen Daubert, broke in 2015.70

  - Fix server race condition that could cause sessions to     hang on exit,     https://github.com/robotframework/SSHLibrary/issues/128

  - dropbear was updated to upstream version 2015.70

  - Fix server password authentication on Linux, broke in     2015.69

  - Fix crash when forwarded TCP connections fail to connect     (bug introduced in 2015.68)

  - Avoid hang on session close when multiple sessions are     started, affects Qt Creator Patch from Andrzej     Szombierski

  - Reduce per-channel memory consumption in common case,     increase default channel limit from 100 to 1000 which     should improve SOCKS forwarding for modern webpages

  - Handle multiple command line arguments in a single flag,     thanks to Guilhem Moulin

  - Manpage improvements from Guilhem Moulin

  - Build fixes for Android from Mike Frysinger

  - Don't display the MOTD when an explicit command is run     from Guilhem Moulin

  - Check curve25519 shared secret isn't zero

  - dropbear was updated to upstream version 2015.68

  - Reduce local data copying for improved efficiency.
    Measured 30% increase in throughput for connections to     localhost

  - Forwarded TCP ports connect asynchronously and try all     available addresses (IPv4, IPv6, round robin DNS)

  - Fix all compile warnings, many patches from Ga&euml;l     Portay Note that configure with -Werror may not be     successful on some platforms (OS X) and some     configuration options may still result in unused     variable warnings.

  - Use TCP Fast Open on Linux if available. Saves a round     trip at connection to hosts that have previously been     connected. Needs a recent Linux kernel and possibly     'sysctl -w net.ipv4.tcp_fastopen=3' Client side is     disabled by default pending further compatibility     testing with networks and systems.

  - Increase maximum command length to 9000 bytes

  - Free memory before exiting, patch from Thorsten     Horstmann. Useful for Dropbear ports to embedded systems     and for checking memory leaks with valgrind. Only     partially implemented for dbclient. This is disabled by     default, enable with DROPBEAR_CLEANUP in sysoptions.h

  - DROPBEAR_DEFAULT_CLI_AUTHKEY setting now always prepends     home directory unless there is a leading slash (~ isn't     treated specially)

  - Fix small ECC memory leaks

  - Tighten validation of Diffie-Hellman parameters, from     Florent Daigniere of Matta Consulting. Odds of bad     values are around 2**-512 -- improbable.

  - Twofish-ctr cipher is supported though disabled by     default

  - Fix pre-authentication timeout when waiting for client     SSH-2.0 banner, thanks to CL Ouyang

  - Fix NULL pointer crash with restrictions in     authorized_keys without a command, patch from Guilhem     Moulin

  - Ensure authentication timeout is handled while reading     the initial banner, thanks to CL Ouyang for finding it.

  - Fix NULL pointer crash when handling bad ECC keys. Found     by afl-fuzz

  - dropbear was updated to upstream version 2015.67

  - Call fsync() after generating private keys to ensure     they aren't lost if a reboot occurs. Thanks to Peter     Korsgaard

  - Disable non-delayed zlib compression by default on the     server. Can be enabled if required for old clients with     DROPBEAR_SERVER_DELAY_ZLIB

  - Default client key path ~/.ssh/id_dropbear

  - Prefer stronger algorithms by default, from Fedor     Brunner. AES256 over 3DES Diffie-hellman group14 over     group1

  - Add option to disable CBC ciphers.

  - Disable twofish in default options.h

  - Enable sha2 HMAC algorithms by default, the code was     already required for ECC key exchange. sha1 is the first     preference still for performance. 

  - Fix installing dropbear.8 in a separate build directory,     from Like Ma

  - Allow configure to succeed if libtomcrypt/libtommath are     missing, from Elan Ruusam&auml;e

  - Don't crash if ssh-agent provides an unknown type of     key. From Catalin Patulea

  - Minor bug fixes, a few issues found by Coverity scan 

  - dropbear was updated to upstream version 2014.66

  - Use the same keepalive handling behaviour as OpenSSH.
    This will work better with some SSH implementations that     have different behaviour with unknown message types.

  - Don't reply with SSH_MSG_UNIMPLEMENTED when we receive a     reply to our own keepalive message

  - Set $SSH_CLIENT to keep bash happy, patch from Ryan     Cleere

  - Fix wtmp which broke since 2013.62, patch from Whoopie

  - dropbear was updated to upstream version 2014.65

  - Fix 2014.64 regression, server session hang on exit with     scp (and probably others), thanks to NiLuJe for tracking     it down

  - Fix 2014.64 regression, clock_gettime() error handling     which broke on older Linux kernels, reported by NiLuJe

  - Fix 2014.64 regression, writev() could occassionally     fail with EAGAIN which wasn't caught

  - Avoid error message when trying to set QoS on     proxycommand or multihop pipes

  - Use /usr/bin/xauth, thanks to Mike Frysinger

  - Don't exit the client if the local user entry can't be     found, thanks to iquaba

  - added missing systemd entries for     dropbear-keygen.service

  - dropbear was updated to upstream version 2014.64

  - Fix compiling with ECDSA and DSS disabled

  - Don't exit abruptly if too many outgoing packets are     queued for writev(). Patch thanks to Ronny Meeus

  - The -K keepalive option now behaves more like OpenSSH's     'ServerAliveInterval'. If no response is received after     3 keepalives then the session is terminated. This will     close connections faster than waiting for a TCP timeout.

  - Rework TCP priority setting. New settings are if     (connecting || ptys || x11) tos = LOWDELAY else if     (tcp_forwards) tos = 0 else tos = BULK Thanks to Catalin     Patulea for the suggestion.

  - Improve handling of many concurrent new TCP forwarded     connections, should now be able to handle as many as     MAX_CHANNELS. Thanks to Eduardo Silva for reporting and     investigating it.

  - Make sure that exit messages from the client are     printed, regression in 2013.57

  - Use monotonic clock where available, timeouts won't be     affected by system time changes

  - Add -V for version

  - dropbear was updated regular init script to also create     ECDSA keys

  - update to upstream version 2014.63

  - Fix ~. to terminate a client interactive session after     waking a laptop from sleep.

  - Changed port separator syntax again, now using     host^port. This is because IPv6 link-local addresses use     %. Reported by Gui Iribarren

  - Avoid constantly relinking dropbearmulti target, fix     'make install' for multi target, thanks to Mike     Frysinger

  - Avoid getting stuck in a loop writing huge key files,     reported by Bruno Thomsen

  - Don't link dropbearkey or dropbearconvert to libz or     libutil, thanks to Nicolas Boos

  - Fix linking -lcrypt on systems without /usr/lib, thanks     to Nicolas Boos

  - Avoid crash on exit due to cleaned up keys before last     packets are sent, debugged by Ronald Wahl

  - Fix a race condition in rekeying where Dropbear would     exit if it received a still-in-flight packet after     initiating rekeying. Reported by Oliver Metz. This is a     longstanding bug but is triggered more easily since     2013.57

  - [...]

  - dropbear was updated service files and activated     building of ecdsa keys

  - only package the old init service in distributions     without systemd

  - imported upstream version 2013.62

  - Disable 'interactive' QoS connection options when a     connection doesn't have a PTY (eg scp, rsync). Thanks to     Catalin Patulea for the patch.

  - Log when a hostkey is generated with -R, fix some bugs     in handling server hostkey commandline options

  - Fix crash in Dropbearconvert and 521 bit key, reported     by NiLuJe

  - Update config.guess and config.sub again

  - ECC (elliptic curve) support. Supports ECDSA hostkeys     (requires new keys to be generated) and ECDH for setting     up encryption keys (no intervention required). This is     significantly faster.

  - curve25519-sha256@libssh.org support for setting up     encryption keys. This is another elliptic curve mode     with less potential of NSA interference in algorithm     parameters. curve25519-donna code thanks to Adam Langley

  - -R option to automatically generate hostkeys. This is     recommended for embedded platforms since it allows the     system random number device /dev/urandom a longer     startup time to generate a secure seed before the     hostkey is required.

  - Compile fixes for old vendor compilers like Tru64 from     Daniel Richard G.

  - Make authorized_keys handling more robust, don't exit     encountering malformed lines. Thanks to Lorin Hochstein     and Mark Stillwell

dropbear was updated to 2016.72 to fix the following issues :

Changes in dropbear :

  - updated to upstream version 2016.72

  - Validate X11 forwarding input. Could allow bypass of     authorized_keys command= restrictions, found by     github.com/tintinweb. Thanks for Damien Miller for a     patch.

  - used as bug fix release for boo#970633 - CVE-2016-3116

  - updated to upstream version 2015.71

  - Fix 'bad buf_incrpos' when data is transferred, broke in     2015.69

  - Fix crash on exit when -p address:port is used, broke in     2015.68

  - Fix building with only ENABLE_CLI_REMOTETCPFWD given,     patch from Konstantin Tokarev

  - Fix bad configure script test which didn't work with     dash shell, patch from Juergen Daubert, broke in 2015.70

  - Fix server race condition that could cause sessions to     hang on exit,     https://github.com/robotframework/SSHLibrary/issues/128

  - updated to upstream version 2015.70

  - Fix server password authentication on Linux, broke in     2015.69

  - Fix crash when forwarded TCP connections fail to connect     (bug introduced in 2015.68)

  - Avoid hang on session close when multiple sessions are     started, affects Qt Creator Patch from Andrzej     Szombierski

  - Reduce per-channel memory consumption in common case,     increase default channel limit from 100 to 1000 which     should improve SOCKS forwarding for modern webpages

  - Handle multiple command line arguments in a single flag,     thanks to Guilhem Moulin

  - Manpage improvements from Guilhem Moulin

  - Build fixes for Android from Mike Frysinger

  - Don't display the MOTD when an explicit command is run     from Guilhem Moulin

  - Check curve25519 shared secret isn't zero

  - updated to upstream version 2015.68

  - Reduce local data copying for improved efficiency.
    Measured 30% increase in throughput for connections to     localhost

  - Forwarded TCP ports connect asynchronously and try all     available addresses (IPv4, IPv6, round robin DNS)

  - Fix all compile warnings, many patches from Ga&euml;l     Portay Note that configure with -Werror may not be     successful on some platforms (OS X) and some     configuration options may still result in unused     variable warnings.

  - Use TCP Fast Open on Linux if available. Saves a round     trip at connection to hosts that have previously been     connected. Needs a recent Linux kernel and possibly     'sysctl -w net.ipv4.tcp_fastopen=3' Client side is     disabled by default pending further compatibility     testing with networks and systems.

  - Increase maximum command length to 9000 bytes

  - Free memory before exiting, patch from Thorsten     Horstmann. Useful for Dropbear ports to embedded systems     and for checking memory leaks with valgrind. Only     partially implemented for dbclient. This is disabled by     default, enable with DROPBEAR_CLEANUP in sysoptions.h

  - DROPBEAR_DEFAULT_CLI_AUTHKEY setting now always prepends     home directory unless there is a leading slash (~ isn't     treated specially)

  - Fix small ECC memory leaks

  - Tighten validation of Diffie-Hellman parameters, from     Florent Daigniere of Matta Consulting. Odds of bad     values are around 2**-512 -- improbable.

  - Twofish-ctr cipher is supported though disabled by     default

  - Fix pre-authentication timeout when waiting for client     SSH-2.0 banner, thanks to CL Ouyang

  - Fix NULL pointer crash with restrictions in     authorized_keys without a command, patch from Guilhem     Moulin

  - Ensure authentication timeout is handled while reading     the initial banner, thanks to CL Ouyang for finding it.

  - Fix NULL pointer crash when handling bad ECC keys. Found     by afl-fuzz

  - fixed checksum URL

  - updated to upstream version 2015.67

  - Call fsync() after generating private keys to ensure     they aren't lost if a reboot occurs. Thanks to Peter     Korsgaard

  - Disable non-delayed zlib compression by default on the     server. Can be enabled if required for old clients with     DROPBEAR_SERVER_DELAY_ZLIB

  - Default client key path ~/.ssh/id_dropbear

  - Prefer stronger algorithms by default, from Fedor     Brunner. AES256 over 3DES Diffie-hellman group14 over     group1

  - Add option to disable CBC ciphers.

  - Disable twofish in default options.h

  - Enable sha2 HMAC algorithms by default, the code was     already required for ECC key exchange. sha1 is the first     preference still for performance. 

  - Fix installing dropbear.8 in a separate build directory,     from Like Ma

  - Allow configure to succeed if libtomcrypt/libtommath are     missing, from Elan Ruusam&auml;e

  - Don't crash if ssh-agent provides an unknown type of     key. From Catalin Patulea

  - Minor bug fixes, a few issues found by Coverity scan 

  - replaced deprecated gpg-offline check by     obs-service-source_validator

  - updated to upstream version 2014.66

  - Use the same keepalive handling behaviour as OpenSSH.
    This will work better with some SSH implementations that     have different behaviour with unknown message types.

  - Don't reply with SSH_MSG_UNIMPLEMENTED when we receive a     reply to our own keepalive message

  - Set $SSH_CLIENT to keep bash happy, patch from Ryan     Cleere

  - Fix wtmp which broke since 2013.62, patch from Whoopie

According to its self-reported version in the banner, the version of Dropbear SSH running on the remote host is prior to 2016.72. It is, therefore, affected by a command injection vulnerability when X11 Forwarding is enabled, due to improper sanitization of X11 authentication credentials. An authenticated, remote attacker can exploit this to execute arbitrary xauth commands on the remote host.

Note that X11 Forwarding is not enabled by default.

Matt Johnson reports :

Validate X11 forwarding input. Could allow bypass of authorized_keys command= restrictions

ID	Name	Product	Family	Severity
700027	Dropbear SSH < 2016.72.0 Command Injection	Nessus Network Monitor	SSH	medium
92670	Fedora 23 : dropbear (2016-6de0b19b3b)	Nessus	Fedora Local Security Checks	medium
92478	GLSA-201607-08 : Dropbear: Privilege escalation	Nessus	Gentoo Local Security Checks	medium
90225	Fedora 24 : dropbear-2016.72-1.fc24 (2016-bc45faa824)	Nessus	Fedora Local Security Checks	medium
90168	openSUSE Security Update : dropbear (openSUSE-2016-393)	Nessus	SuSE Local Security Checks	medium
90165	openSUSE Security Update : dropbear (openSUSE-2016-387)	Nessus	SuSE Local Security Checks	medium
90132	Fedora 22 : dropbear-2016.72-1.fc22 (2016-40a657cee1)	Nessus	Fedora Local Security Checks	medium
90129	Fedora 23 : dropbear-2016.72-1.fc23 (2016-332491de28)	Nessus	Fedora Local Security Checks	medium
90027	Dropbear SSH Server < 2016.72 xauth Command Injection	Nessus	Misc.	medium
89928	FreeBSD : dropbear -- authorized_keys command= bypass (8eb78cdc-e9ec-11e5-85be-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2016-3116

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium