Net::Dropbear Integer Overflow Vulnerability in LibTomMath Library

A critical integer overflow vulnerability has been identified in Net::Dropbear versions through 0.16 for Perl. This vulnerability arises from an embedded version of the LibTomMath library, which is susceptible to an integer overflow in the 'mp_grow' function. The flaw allows attackers to execute arbitrary code and cause a denial-of-service condition.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution and the introduction of a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by using Net::Dropbear versions through 0.16 for Perl. The integer overflow occurs in the 'mp_grow' function of the embedded LibTomMath library, where a negative size argument can be passed, leading to improper memory allocation and potential code execution.

Remediation

Users can upgrade to Net::Dropbear versions 1.2.1 or later, which includes the necessary patch to address this vulnerability.