The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double free in cleanup of TCP listeners when the -a option is enabled.

Security fixes for CVE-2017-9078 CVE-2017-9079

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Matt Johnston reports :

Fix double-free in server TCP listener cleanup A double-free in the server could be triggered by an authenticated user if dropbear is running with -a (Allow connections to forwarded ports from any host) This could potentially allow arbitrary code execution as root by an authenticated user.

Fix information disclosure with ~/.ssh/authorized_keys symlink.
Dropbear parsed authorized_keys as root, even if it were a symlink.
The fix is to switch to user permissions when opening authorized_keys.

Two vulnerabilities were found in Dropbear, a lightweight SSH2 server and client :

  - CVE-2017-9078     Mark Shepard discovered a double free in the TCP     listener cleanup which could result in denial of service     by an authenticated user if Dropbear is running with the     '-a' option.

  - CVE-2017-9079     Jann Horn discovered a local information leak in parsing     the .authorized_keys file.

ID	Name	Product	Family	Severity
101694	Fedora 26 : dropbear (2017-a50319c820)	Nessus	Fedora Local Security Checks	high
101217	FreeBSD : Dropbear -- two vulnerabilities (60931f98-55a7-11e7-8514-589cfc0654e1)	Nessus	FreeBSD Local Security Checks	high
100608	Fedora 24 : dropbear (2017-b22de5c767)	Nessus	Fedora Local Security Checks	high
100607	Fedora 25 : dropbear (2017-8e9bd58cbb)	Nessus	Fedora Local Security Checks	high
100306	Debian DSA-3859-1 : dropbear - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-9078

high

Tenable Plugins

high

high

high

high

high