[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <42b72ad8-61d2-48f6-9d29-0774149e344e@gmail.com>
Date: Mon, 12 May 2025 20:47:38 +0200
From: Albert Veli <albert.veli@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Dropbear SSH 2025.88 fixes CVE-2025-47203
Hi!
On 2025-05-09 18:15, Alan Coopersmith wrote:
> https://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2025q2/002385.html
> announces the release of Dropbear SSH 2025.88 including this fix:
>
>> - Security: Don't allow dbclient hostname arguments to be interpreted
>> by the shell.
>>
>> dbclient hostname arguments with a comma (for multihop) would be
>> passed to the shell which could result in running arbitrary shell
>> commands locally. That could be a security issue in situations
>> where dbclient is passed untrusted hostname arguments.
>>
>> Now the multihop command is executed directly, no shell is involved.
>> Thanks to Marcin Nowak for the report, tracked as CVE-2025-47203
I'm currently triaging CVE-2025-47203 to determine whether an embedded
system we maintain is actually affected. It runs 2024.86, and is built
with DROPBEAR_CLI_PROXYCMD and DROPBEAR_CLI_MULTIHOP enabled.
However, despite attempting various multihop hostname inputs containing
shell metacharacters (e.g. semicolons, backticks, pipes, $(cmd)), I’ve
been unable to trigger any shell execution or command injection. All
such inputs are interpreted literally as hostnames.
I have two main questions:
1. Is there a reliable way to confirm from the command line whether I'm
vulnerable?
2. Both dbclient and ssh are symlinks to the same dropbear binary. Does
this CVE apply equally to both, or is it specific to dbclient?
Thanks in advance,
Albert
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
