CVE-2016-3116 - Vulnerability Details - OpenCVE

CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Dropbear Ssh Project	Dropbear Ssh

Configuration 1 [-]

cpe:2.3:a:dropbear_ssh_project:dropbear_ssh:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179261.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179269.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179870.html
http://lists.opensuse.org/opensuse-updates/2016-03/msg00105.html
http://lists.opensuse.org/opensuse-updates/2016-03/msg00113.html
http://packetstormsecurity.com/files/136251/Dropbear-SSHD-xauth-Command-Injection-Bypass.html
http://seclists.org/fulldisclosure/2016/Mar/47
https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115
https://matt.ucc.asn.au/dropbear/CHANGES
https://security.gentoo.org/glsa/201607-08

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2016-03-22T10:00:00

Updated: 2024-08-05T23:47:57.124Z

Reserved: 2016-03-10T00:00:00

Link: CVE-2016-3116

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2016-03-22T10:59:03.980

Modified: 2025-04-12T10:46:40.837

Link: CVE-2016-3116

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-03-09T00:00:00", "descriptions": [{"lang": "en", "value": "CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-12-01T16:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://matt.ucc.asn.au/dropbear/CHANGES"}, {"name": "FEDORA-2016-40a657cee1", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179269.html"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/136251/Dropbear-SSHD-xauth-Command-Injection-Bypass.html"}, {"name": "FEDORA-2016-332491de28", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179261.html"}, {"name": "20160314 CVE-2016-3116 - Dropbear SSH xauth injection", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2016/Mar/47"}, {"name": "FEDORA-2016-bc45faa824", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179870.html"}, {"name": "openSUSE-SU-2016:0882", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00113.html"}, {"name": "GLSA-201607-08", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201607-08"}, {"name": "openSUSE-SU-2016:0874", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00105.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-3116", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115", "refsource": "MISC", "url": "https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115"}, {"name": "https://matt.ucc.asn.au/dropbear/CHANGES", "refsource": "CONFIRM", "url": "https://matt.ucc.asn.au/dropbear/CHANGES"}, {"name": "FEDORA-2016-40a657cee1", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179269.html"}, {"name": "http://packetstormsecurity.com/files/136251/Dropbear-SSHD-xauth-Command-Injection-Bypass.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/136251/Dropbear-SSHD-xauth-Command-Injection-Bypass.html"}, {"name": "FEDORA-2016-332491de28", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179261.html"}, {"name": "20160314 CVE-2016-3116 - Dropbear SSH xauth injection", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2016/Mar/47"}, {"name": "FEDORA-2016-bc45faa824", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179870.html"}, {"name": "openSUSE-SU-2016:0882", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00113.html"}, {"name": "GLSA-201607-08", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201607-08"}, {"name": "openSUSE-SU-2016:0874", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00105.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T23:47:57.124Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://matt.ucc.asn.au/dropbear/CHANGES"}, {"name": "FEDORA-2016-40a657cee1", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179269.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/136251/Dropbear-SSHD-xauth-Command-Injection-Bypass.html"}, {"name": "FEDORA-2016-332491de28", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179261.html"}, {"name": "20160314 CVE-2016-3116 - Dropbear SSH xauth injection", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2016/Mar/47"}, {"name": "FEDORA-2016-bc45faa824", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179870.html"}, {"name": "openSUSE-SU-2016:0882", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00113.html"}, {"name": "GLSA-201607-08", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201607-08"}, {"name": "openSUSE-SU-2016:0874", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00105.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-3116", "datePublished": "2016-03-22T10:00:00", "dateReserved": "2016-03-10T00:00:00", "dateUpdated": "2024-08-05T23:47:57.124Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dropbear_ssh_project:dropbear_ssh:*:*:*:*:*:*:*:*", "matchCriteriaId": "A9EAA4E0-ACE7-43B0-B554-26CDA79D6340", "versionEndIncluding": "2015.71", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n CRLF en Dropbear SSH en versiones anteriores a 2016.72 permite a usuarios remotos autenticados eludir las restricciones de comandos de shell previstas a trav\u00e9s del redireccionamiento de datos X11 manipulados."}], "evaluatorComment": "<a href=\"https://cwe.mitre.org/data/definitions/93.html\">CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')</a>", "id": "CVE-2016-3116", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 5.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-03-22T10:59:03.980", "references": [{"source": "cve@mitre.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179261.html"}, {"source": "cve@mitre.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179269.html"}, {"source": "cve@mitre.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179870.html"}, {"source": "cve@mitre.org", "url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00105.html"}, {"source": "cve@mitre.org", "url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00113.html"}, {"source": "cve@mitre.org", "url": "http://packetstormsecurity.com/files/136251/Dropbear-SSHD-xauth-Command-Injection-Bypass.html"}, {"source": "cve@mitre.org", "url": "http://seclists.org/fulldisclosure/2016/Mar/47"}, {"source": "cve@mitre.org", "url": "https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115"}, {"source": "cve@mitre.org", "url": "https://matt.ucc.asn.au/dropbear/CHANGES"}, {"source": "cve@mitre.org", "url": "https://security.gentoo.org/glsa/201607-08"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179261.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179269.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179870.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00105.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00113.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://packetstormsecurity.com/files/136251/Dropbear-SSHD-xauth-Command-Injection-Bypass.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2016/Mar/47"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://matt.ucc.asn.au/dropbear/CHANGES"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201607-08"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}