Skip to content
Snippets Groups Projects
Select Git revision
5 results
Search by author
  • Any Author
0 authors
  1. May 21, 2017
    • Kevin Darbyshire-Bryant's avatar
      dropbear: bump to 2017.75 · 6e10fc74
      Kevin Darbyshire-Bryant authored 
      - Security: Fix double-free in server TCP listener cleanup A double-free
in the server could be triggered by an authenticated user if dropbear is
running with -a (Allow connections to forwarded ports from any host)
This could potentially allow arbitrary code execution as root by an
authenticated user.  Affects versions 2013.56 to 2016.74. Thanks to Mark
Shepard for reporting the crash.
CVE-2017-9078 https://secure.ucc.asn.au/hg/dropbear/rev/c8114a48837c

- Security: Fix information disclosure with ~/.ssh/authorized_keys
symlink.  Dropbear parsed authorized_keys as root, even if it were a
symlink.  The fix is to switch to user permissions when opening
authorized_keys

A user could symlink their ~/.ssh/authorized_keys to a root-owned file
they couldn't normally read. If they managed to get that file to contain
valid authorized_keys with command= options it might be possible to read
other contents of that file.
This information disclosure is to an already authenticated user.
Thanks to Jann Horn of Google Project Zero for reporting this.
CVE-2017-9079 https://secure.ucc.asn.au/hg/dropbear/rev/0d889b068123



Refresh patches, rework 100-pubkey_path.patch to work with new
authorized_keys validation.

Signed-off-by: default avatarKevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
      6e10fc74
  3. Feb 17, 2017
  5. Jan 05, 2017
  7. Dec 16, 2016
  9. Dec 14, 2016
  11. Sep 26, 2016
  13. Sep 10, 2016
  15. Aug 12, 2016
    • Jo-Philipp Wich's avatar
      dropbear: security update to 2016.74 · 4e8c6f34
      Jo-Philipp Wich authored 
      
- Security: Message printout was vulnerable to format string injection.

  If specific usernames including "%" symbols can be created on a system
  (validated by getpwnam()) then an attacker could run arbitrary code as root
  when connecting to Dropbear server.

  A dbclient user who can control username or host arguments could potentially
  run arbitrary code as the dbclient user. This could be a problem if scripts
  or webpages pass untrusted input to the dbclient program.

- Security: dropbearconvert import of OpenSSH keys could run arbitrary code as
  the local dropbearconvert user when parsing malicious key files

- Security: dbclient could run arbitrary code as the local dbclient user if
  particular -m or -c arguments are provided. This could be an issue where
  dbclient is used in scripts.

- Security: dbclient or dropbear server could expose process memory to the
  running user if compiled with DEBUG_TRACE and running with -v

  The security issues were reported by an anonymous researcher working with
  Beyond Security's SecuriTeam Secure Disclosure www.beyondsecurity.com/ssd.html

Signed-off-by: default avatarJo-Philipp Wich <jo@mein.io>
      4e8c6f34
  17. May 24, 2016
  19. May 13, 2016
  21. May 12, 2016
  23. Apr 28, 2016
  25. Feb 08, 2016
  27. Jan 15, 2016
  29. Jan 10, 2016
  31. Sep 08, 2015
  33. Sep 07, 2015
  35. Sep 02, 2015
  37. Apr 18, 2015
  39. Nov 06, 2014
  41. Aug 21, 2014
  43. Aug 11, 2014
  45. Mar 29, 2014
  47. Oct 15, 2013
  49. Oct 10, 2013
  51. Dec 04, 2012
  53. Oct 19, 2012
    • Hamish Guthrie's avatar
      licensing: Add licensing metadata to many packages Two new variables are... · 81a3d9ba
      Hamish Guthrie authored 
      licensing: Add licensing metadata to many packages Two new variables are introduces to many packages, namely PKG_LICENSE and PKG_LICENSE_FILES - there may be more than one license applied to packages, and these are listed in the PKG_LICENSE variable and separated by spaces. All relevant license files are also added to the PKG_LICENSE_FILES variable, also space separated.

The licensing metadata is put into the bin/<platform>/packages/Packages file
for later parsing. A script for that is on it's way!

SVN-Revision: 33861
      81a3d9ba
  55. Oct 10, 2012
  57. Sep 23, 2012
  59. Feb 25, 2012
  61. Nov 25, 2011
  63. Nov 07, 2011
  65. Nov 03, 2011
  67. Jul 31, 2011
  69. Apr 01, 2011
    • John Crispin's avatar
      r25831 reduced the size of the dropbear executable by, among other things, · 9fd342d9
      John Crispin authored 
      disabling support for keyboard-interactive authentication. The default
sshd configuration on Mac OS X only permits keyboard-interactive and
public-key authentication, so unless a public key is set up, the default
OpenWrt ssh client is now unable to connect to Mac OS X hosts. This patch
re-enables keyboard-interactive authentication.

In my tests, this increases the size of the stripped dropbear executable
by 416 bytes on mips and 1,104 bytes on mipsel. In my opinion, such a
small space savings isn't worthwhile when the resultant executable is
severely hamstrung.

Signed-off-by: default avatarMark Mentovai <mark@moxienet.com>

SVN-Revision: 26390
      9fd342d9
  71. Mar 02, 2011