Dropbear - Local Information Leak in Parsing .authorized_keys File
Summary
DLA-948-1: dropbear - security update. Affects dropbear versions < 2012.55-1.3+deb7u2. Fixed in 2012.55-1.3+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dropbear is a lightweight SSH2 server and client. It is designed to be small yet fully functional and secure. Dropbear is commonly used in embedded systems and low-resource environments where a full-featured SSH implementation may be too resource-intensive. However, a vulnerability has been discovered in Dropbear that allows for a local information leak in parsing the .authorized_keys file.
Vulnerability Detail
The vulnerability, identified as CVE-2017-9079, was discovered by Jann Horn. It affects the parsing of the .authorized_keys file in Dropbear. An attacker with local access to the system can exploit this vulnerability to leak sensitive information. The .authorized_keys file is used for SSH public key authentication, and the vulnerability allows an attacker to read the contents of this file, potentially exposing SSH keys and other sensitive data.
How To Fix
Minimum fixed version
2012.55-1.3+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade dropbearTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to restrict physical access to the system and ensure that only trusted users have local access. Additionally, it is important to regularly monitor and review the .authorized_keys file for any unauthorized changes.
Conclusion
The vulnerability in Dropbear that allows for a local information leak in parsing the .authorized_keys file can be mitigated by upgrading to the latest version of the dropbear package. It is important to promptly apply the necessary updates to ensure the security of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dropbear →
FAQ
Dropbear is a lightweight SSH2 server and client designed for resource-constrained environments.
The vulnerability allows for a local information leak, potentially exposing sensitive data such as SSH keys.
The vulnerability was discovered by Jann Horn.
To fix this vulnerability, you should upgrade the dropbear package to version 2012.55-1.3+deb7u2 or later.
While no specific workaround is mentioned, it is recommended to restrict physical access to the system and regularly monitor the .authorized_keys file.
Related vulnerabilities
Recent vulnerabilities recorded for dropbear.
