CVE-2017-9078

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-05-19 · updated 2026-06-17
Weakness: CWE-415

Description

The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double free in cleanup of TCP listeners when the -a option is enabled.

Affected products

Debian Linux: 8.0
[UNKNOWN] dropbear: before 2017.75 — fixed in 2017.75
NetApp H410C Firmware: all versions

How to fix

Upgrade to a fixed version: [UNKNOWN] dropbear 2017.75. Check the vendor advisory for mitigations.

References

http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2017q2/001985.html
http://www.debian.org/security/2017/dsa-3859
https://security.netapp.com/advisory/ntap-20191004-0006/
http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2017q2/001985.html
http://www.debian.org/security/2017/dsa-3859
https://security.netapp.com/advisory/ntap-20191004-0006/

Get alerted when CVE-2017-9078 or the next vulnerability affects your stack