Dropbear SSH Server Username Format String Vulnerability
BID:8439
Info
Dropbear SSH Server Username Format String Vulnerability
| Bugtraq ID: | 8439 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 18 2003 12:00AM |
| Updated: | Aug 18 2003 12:00AM |
| Credit: | The discovery of this vulnerability has been credit to Joel Eriksson of 0xbadc0ded. |
| Vulnerable: |
Dropbear SSH Server 0.34 Dropbear SSH Server 0.33 Dropbear SSH Server 0.32 Dropbear SSH Server 0.31 Dropbear SSH Server 0.30 Dropbear SSH Server 0.29 Dropbear SSH Server 0.28 |
| Not Vulnerable: |
Dropbear SSH Server 0.35 |
Discussion
Dropbear SSH Server Username Format String Vulnerability
A remote vulnerability has been discovered in Dropbear SSH Server that could allow an attacker to execute arbitrary code on a target system. The issue lies in a format string error while calling the syslog() function during the authentication stage.
As a result of this bug, an attacker may be capable of passing specifically calculated format specifiers embedded within the supplied username. When this value is later stored in a buffer and passed to an incorrectly formatted call to the syslog() function, the attacker-supplied format specifiers be interpreted and thus influence the flow of execution within the program; ultimately resulting in the execution of arbitrary code.
This vulnerability affects Dropbear SSH Server v0.34 and earlier.
A remote vulnerability has been discovered in Dropbear SSH Server that could allow an attacker to execute arbitrary code on a target system. The issue lies in a format string error while calling the syslog() function during the authentication stage.
As a result of this bug, an attacker may be capable of passing specifically calculated format specifiers embedded within the supplied username. When this value is later stored in a buffer and passed to an incorrectly formatted call to the syslog() function, the attacker-supplied format specifiers be interpreted and thus influence the flow of execution within the program; ultimately resulting in the execution of arbitrary code.
This vulnerability affects Dropbear SSH Server v0.34 and earlier.