Local File Read Vulnerability in Dropbear SSH Server
Summary
ALPINE-CVE-2017-9079: Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. Affects dropbear versions < 2017.75-r0. Fixed in 2017.75-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dropbear is a lightweight SSH server and client designed for resource-limited environments. It is commonly used in embedded systems and provides secure shell access to remote machines. The package is known for its small footprint and efficiency, making it a popular choice for various applications. However, certain configurations can expose it to vulnerabilities, such as the one identified in CVE-2017-9079.
Vulnerability Detail
The vulnerability identified as CVE-2017-9079 affects Dropbear versions prior to 2017.75. It allows local users to read sensitive files as root if those files are formatted with the 'authorized_keys' file format containing a 'command=' option. This occurs because the '~/.ssh/authorized_keys' file is read with root privileges, and symlinks are followed, potentially leading to unauthorized access to sensitive information.
How To Fix
Minimum fixed version
2017.75-r0
This is the first release that contains the fix.
sudo apk add --upgrade dropbearTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the '~/.ssh/authorized_keys' file by changing its permissions to prevent unauthorized users from reading it. Use the command: 'chmod 600 ~/.ssh/authorized_keys'. This will limit access to the file to only the owner.
Conclusion
In summary, CVE-2017-9079 is a significant vulnerability in the Dropbear SSH server that can allow local users to access sensitive files as root. It is crucial to update to the patched version to mitigate this risk. Additionally, implementing workarounds can provide temporary relief while ensuring that your systems remain secure.
See every vulnerability recorded for dropbear →
FAQ
CVE-2017-9079 is a vulnerability in Dropbear that allows local users to read certain files as root due to improper handling of the 'authorized_keys' file.
You can check your version of Dropbear by running 'dropbear -V' in your terminal. If it is below 2017.75, it is vulnerable.
If exploited, this vulnerability can lead to unauthorized access to sensitive files, potentially compromising system security.
Yes, tools like Vulert can monitor your applications for open-source vulnerabilities in real-time using just a manifest file.
The CVSS score for CVE-2017-9079 is 4.7, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for dropbear.
