Mercurial > dropbear

comparison CHANGES @ 1311:10f28c95ca31

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
changelogs
author Matt Johnston <matt@ucc.asn.au>
date Thu, 21 Jul 2016 23:04:24 +0800
parents 309e1c4a8768
children 0ed3d2bbf956
comparison
equal deleted inserted replaced
1310:090033317ca1 1311:10f28c95ca31
1 2016.74 - 21 July 2016
2
3 - Security: Message printout was vulnerable to format string injection.
4
5 If specific usernames including "%" symbols can be created on a system
6 (validated by getpwnam()) then an attacker could run arbitrary code as root
7 when connecting to Dropbear server.
8
9 A dbclient user who can control username or host arguments could potentially
10 run arbitrary code as the dbclient user. This could be a problem if scripts
11 or webpages pass untrusted input to the dbclient program.
12
13 - Security: dropbearconvert import of OpenSSH keys could run arbitrary code as
14 the local dropbearconvert user when parsing malicious key files
15
16 - Security: dbclient could run arbitrary code as the local dbclient user if
17 particular -m or -c arguments are provided. This could be an issue where
18 dbclient is used in scripts.
19
20 - Security: dbclient or dropbear server could expose process memory to the
21 running user if compiled with DEBUG_TRACE and running with -v
22
23 The security issues were reported by an anonymous researcher working with
24 Beyond Security's SecuriTeam Secure Disclosure www.beyondsecurity.com/ssd.html
25
26 - Fix port forwarding failure when connecting to domains that have both
27 IPv4 and IPv6 addresses.
28
29 - Fix 100% CPU use while waiting for rekey to complete. Thanks to Zhang Hui P
30 for the patch
31
32
1 2016.73 - 18 March 2016 33 2016.73 - 18 March 2016
2 34
3 - Support syslog in dbclient, option -o usesyslog=yes. Patch from Konstantin Tokarev 35 - Support syslog in dbclient, option -o usesyslog=yes. Patch from Konstantin Tokarev
4 36
5 - Kill a proxycommand when dbclient exits, patch from Konstantin Tokarev 37 - Kill a proxycommand when dbclient exits, patch from Konstantin Tokarev