Ask the Community
Groups
CVE-2016-7406: Format string vulnerability in Dropbear SSH - Connect IT Community | Kaseya
<main> <article class="userContent"> <h3 data-id="summary"><strong>SUMMARY</strong></h3> <p>False positive</p> <h3 data-id="cve-id"><strong>CVE ID</strong></h3> <p>CVE-2016-7406 CVE-2016-7407 CVE-2016-7408 CVE-2016-7409</p> <h3 data-id="description"><strong>DESCRIPTION</strong></h3> <p><br>Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.<br><br>Unitrends assessment: OS software is Not Exposed<br><br>The dropbear ssh server is not the same as the openssh-server package. Our CentOS installations use the openssh-server package instead.<br><br>However, if the Unitrends system has SuperMicro X10DRH-CT firmware 3.26, this firmware version includes a DropBear SSH instance for a firmware management CLI, if the IPMI LAN port is configured and \enabled. <br><br> </p> <h3 data-id="resolution"><strong>RESOLUTION</strong></h3> <p></p> <p><br>Unitrends servers: OS software is Not Exposed. dropbear ssh is not installed, so this is a false positive if shown in a scan for the OS IP address.<br>The flaw was fixed in a dropbear-2016.74 package from the Fedora EPEL repository.<br><br>If the scan shows this on the IPMI LAN IP address, below is the resolution for the SuperMicro firmware.<br>For the SuperMicro firmware instance, run 'ipmiutil health' to check if the system has firmware 3.26:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0"> [root@Recovery926S ~]# ipmiutil health ipmiutil ver 3.01 ihealth ver 3.01 BMC manufacturer = 002a7c (SuperMicro), product = 0859 (X10DRH) BMC version = 3.26, IPMI v2.0</pre> <p>If so, upgrading the SuperMicro firmware to X10DRH firmware version 3.65 via the IPMI LAN web interface will resolve this. <br> </p> <h3 data-id="link-to-advisories"><strong>LINK TO ADVISORIES</strong></h3> <p></p> <ul><li><a rel="nofollow" href="/home/leaving?allowTrusted=1&target=https%3A%2F%2Fcve.mitre.org%2Fcgi-bin%2Fcvename.cgi%3Fname%3DCVE-2016-7406%25C2%25A0%250D%250Ahttps%3A%2F%2Fbugzilla.redhat.com%2Fshow_bug.cgi%3Fid%3D1376353">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7406 https://bugzilla.redhat.com/show_bug.cgi?id=1376353</a></li></ul> </article> </main>