vulnwire
6.4med

CVE-2016-31161 exploit

CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions…

Published 10 y ago · modified 4 mo ago · JSON

CVSS
6.4
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
19.8%
percentile 97%
Public exploits
1
Exploit-DB

CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.

Exploit prediction (EPSS)

19.80% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

Exploits and detections

  • EDB-40119 DropBearSSHD 2015.71 - Command Injection · remote · 2016-03-03

CVSS scores

Assigned byVersionScoreVector
NVD3.06.4CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
NVD2.05.5AV:N/AC:L/Au:S/C:P/I:P/A:N

References

  • github.com /tintinweb/pub/tree/master/pocs/cve-2016-3115 · x_refsource_MISC, x_transferred
  • matt.ucc.asn.au /dropbear/CHANGES · x_refsource_CONFIRM, x_transferred
  • lists.fedoraproject.org /pipermail/package-announce/2016-March/179269.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • packetstormsecurity.com /files/136251/Dropbear-SSHD-xauth-Command-Injection-Bypass.html · x_refsource_MISC, x_transferred
  • lists.fedoraproject.org /pipermail/package-announce/2016-March/179261.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • seclists.org /fulldisclosure/2016/Mar/47 · mailing-list, x_refsource_FULLDISC, x_transferred
  • lists.fedoraproject.org /pipermail/package-announce/2016-March/179870.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • lists.opensuse.org /opensuse-updates/2016-03/msg00113.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • security.gentoo.org /glsa/201607-08 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • lists.opensuse.org /opensuse-updates/2016-03/msg00105.html · vendor-advisory, x_refsource_SUSE, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.