CVE-2016-7407

Name of the Vulnerable Software and Affected Versions Dropbear SSH versions prior to 2016.74

Description The issue allows attackers to execute arbitrary code via a crafted OpenSSH key file. This is due to insufficient input validation in the Dropbear SSH package. The dropbearconvert command is specifically vulnerable to this issue, allowing a remote attacker to execute arbitrary code using a specially prepared OpenSSH key file.

Recommendations For versions prior to 2016.74, update to version 2016.74 or later to resolve the issue. As a temporary workaround, consider restricting the use of the dropbearconvert command until a patch is applied. Avoid using the dropbearconvert command with untrusted OpenSSH key files until the issue is resolved.