Re: CVE-2016-3116: dropbear: X11 forwarding input not validated properly

[Alexander Kanavin <alexander.kanavin@linux.intel.com>]

On 09/14/2016 01:24 PM, Sona Sarmadi wrote:

> Thanks guys for your feedbacks. I agree that by default we shouldn't upgrade package
> versions in stable branches as far as possible but sometimes we have to. If there isn't a
> suitable patch I personally prefer upgrading (only if it is minor changes) rather than
> sticking to a vulnerable version. We have done this in the past e.g. for OpenSSL (from
> 1.0.1x to 1.0.1y).

See, often the upstream does have a way to get security fixes out to 
users in a way that doesn't bundle unrelated feature additions and 
changes. By saying 'we should trust the upstream' I mean that we should 
try to fix security in a way provided by upstream instead of doing the 
backporting ourselves (where frequently we have no idea what we're 
really doing because we don't know the codebase, or it's otherwise too 
hard for various reasons).

> I will do some investigation to find out if https://secure.ucc.asn.au/hg/dropbear/rev/a3e8389e01ff
> is the fix for CVE-2016-3116 (by quick analysis it looks the right patch) and use that patch and NOT
> upgrade the dropbear version in krogoth !!

After looking at commit tree, I'm pretty certain that it is. And you can 
just update to 2016.72 because it is the only change in that version.

Alex