[source] dropbear: security update to 2016.74

[LEDE Commits]

jow pushed a commit to source.git, branch master:
https://git.lede-project.org/?p=source.git;a=commitdiff;h=4e8c6f340751c66a602b98b727af28b2a9004313

commit 4e8c6f340751c66a602b98b727af28b2a9004313
Author: Jo-Philipp Wich <jo at mein.io>
AuthorDate: Fri Aug 12 11:44:07 2016 +0200

    dropbear: security update to 2016.74
    
    - Security: Message printout was vulnerable to format string injection.
    
      If specific usernames including "%" symbols can be created on a system
      (validated by getpwnam()) then an attacker could run arbitrary code as root
      when connecting to Dropbear server.
    
      A dbclient user who can control username or host arguments could potentially
      run arbitrary code as the dbclient user. This could be a problem if scripts
      or webpages pass untrusted input to the dbclient program.
    
    - Security: dropbearconvert import of OpenSSH keys could run arbitrary code as
      the local dropbearconvert user when parsing malicious key files
    
    - Security: dbclient could run arbitrary code as the local dbclient user if
      particular -m or -c arguments are provided. This could be an issue where
      dbclient is used in scripts.
    
    - Security: dbclient or dropbear server could expose process memory to the
      running user if compiled with DEBUG_TRACE and running with -v
    
      The security issues were reported by an anonymous researcher working with
      Beyond Security's SecuriTeam Secure Disclosure www.beyondsecurity.com/ssd.html
    
    Signed-off-by: Jo-Philipp Wich <jo at mein.io>
---
 package/network/services/dropbear/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/network/services/dropbear/Makefile b/package/network/services/dropbear/Makefile
index 9d62e92..36bcb4a 100644
--- a/package/network/services/dropbear/Makefile
+++ b/package/network/services/dropbear/Makefile
@@ -8,14 +8,14 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dropbear
-PKG_VERSION:=2016.73
+PKG_VERSION:=2016.74
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:= \
 	http://matt.ucc.asn.au/dropbear/releases/ \
 	https://dropbear.nl/mirror/releases/
-PKG_MD5SUM:=8d6d78ce60ca52350ec04fcbd711ce9b
+PKG_MD5SUM:=9ad0172731e0f16623937804643b5bd8
 
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE libtomcrypt/LICENSE libtommath/LICENSE