CVE-2016-7409

Published: Mar 3, 2017Modified: May 13, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read process memory via the -v argument, related to a failed remote ident.

Affected (1)

Products: Dropbear Ssh Project: Dropbear Ssh

Dropbear Ssh Project

1 product

Dropbear Ssh

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Dropbear Ssh Project Dropbear Ssh	Up to 2016.73

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (10)

http://www.openwall.com/lists/oss-security/2016/09/15/2

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/bid/92973

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=1376353

Source: cve@mitre.org

Issue Tracking

https://secure.ucc.asn.au/hg/dropbear/rev/6a14b1f6dc04

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://security.gentoo.org/glsa/201702-23

Source: cve@mitre.org

PatchThird Party AdvisoryVDB Entry

http://www.openwall.com/lists/oss-security/2016/09/15/2