CVE-2016-7409 Information disclosure in n/a
Local users can read process memory in Dropbear SSH when compiled with debug tracing enabled, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-7409?
CVE-2016-7409 is a medium-severity vulnerability in n/a, published on 3 Mar 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read process memory via the -v argument, related to a failed remote ident.
Weakness: CWE-200
Which versions are affected by CVE-2016-7409?
It affects 1 product.
Products include Dropbear Ssh Project Dropbear Ssh.
How do I fix CVE-2016-7409?
Upgrade to a fixed version.
Is CVE-2016-7409 being exploited?
There is no known exploitation of CVE-2016-7409 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2016-7409, GHSA-vqwq-p49h-3hx4, UBUNTU-CVE-2016-7409.