Mercurial > dropbear
comparison CHANGES @ 1318:10e2a7727253 coverity
merge coverity
| author | Matt Johnston <matt@ucc.asn.au> |
|---|---|
| date | Fri, 22 Jul 2016 00:08:02 +0800 |
| parents | 0ed3d2bbf956 |
| children | 2535ea9d0a6f |
comparison
equal
deleted
inserted
replaced
| 1286:7d02b83c61fd | 1318:10e2a7727253 |
|---|---|
| 1 2016.74 - 21 July 2016 | |
| 2 | |
| 3 - Security: Message printout was vulnerable to format string injection. | |
| 4 | |
| 5 If specific usernames including "%" symbols can be created on a system | |
| 6 (validated by getpwnam()) then an attacker could run arbitrary code as root | |
| 7 when connecting to Dropbear server. | |
| 8 | |
| 9 A dbclient user who can control username or host arguments could potentially | |
| 10 run arbitrary code as the dbclient user. This could be a problem if scripts | |
| 11 or webpages pass untrusted input to the dbclient program. | |
| 12 | |
| 13 - Security: dropbearconvert import of OpenSSH keys could run arbitrary code as | |
| 14 the local dropbearconvert user when parsing malicious key files | |
| 15 | |
| 16 - Security: dbclient could run arbitrary code as the local dbclient user if | |
| 17 particular -m or -c arguments are provided. This could be an issue where | |
| 18 dbclient is used in scripts. | |
| 19 | |
| 20 - Security: dbclient or dropbear server could expose process memory to the | |
| 21 running user if compiled with DEBUG_TRACE and running with -v | |
| 22 | |
| 23 The security issues were reported by an anonymous researcher working with | |
| 24 Beyond Security's SecuriTeam Secure Disclosure www.beyondsecurity.com/ssd.html | |
| 25 | |
| 26 - Fix port forwarding failure when connecting to domains that have both | |
| 27 IPv4 and IPv6 addresses. The bug was introduced in 2015.68 | |
| 28 | |
| 29 - Fix 100% CPU use while waiting for rekey to complete. Thanks to Zhang Hui P | |
| 30 for the patch | |
| 31 | |
| 32 | |
| 1 2016.73 - 18 March 2016 | 33 2016.73 - 18 March 2016 |
| 2 | 34 |
| 3 - Support syslog in dbclient, option -o usesyslog=yes. Patch from Konstantin Tokarev | 35 - Support syslog in dbclient, option -o usesyslog=yes. Patch from Konstantin Tokarev |
| 4 | 36 |
| 5 - Kill a proxycommand when dbclient exits, patch from Konstantin Tokarev | 37 - Kill a proxycommand when dbclient exits, patch from Konstantin Tokarev |