CVE-2012-0920: Use After Free
First published: Tue Jun 05 2012(Updated: )
Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54, when command restriction and public key authentication are enabled, allows remote authenticated users to execute arbitrary code and bypass command restrictions via multiple crafted command requests, related to "channels concurrency."
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dropbear SSH | >=0.52<=2012.54 | |
| Debian Linux | =6.0 | |
| Debian Linux | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://matt.ucc.asn.au/dropbear/CHANGES
- http://secunia.com/advisories/48147
- http://secunia.com/advisories/48929
- http://www.debian.org/security/2012/dsa-2456
- http://www.osvdb.org/79590
- http://www.securityfocus.com/bid/52159
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73444
- https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749
- https://www.mantor.org/~northox/misc/CVE-2012-0920.html
Frequently Asked Questions
What is the severity of CVE-2012-0920?
CVE-2012-0920 is considered to be a high severity vulnerability due to its ability to allow remote authenticated users to execute arbitrary code.
How do I fix CVE-2012-0920?
To fix CVE-2012-0920, upgrade to Dropbear SSH Server version 2012.55 or later.
Which software is affected by CVE-2012-0920?
CVE-2012-0920 affects Dropbear SSH Server versions 0.52 through 2012.54 and Debian GNU/Linux versions 6.0 and 7.0.
What types of attacks are possible with CVE-2012-0920?
CVE-2012-0920 can be exploited to bypass command restrictions and execute arbitrary code.
Is user authentication required to exploit CVE-2012-0920?
Yes, CVE-2012-0920 requires remote authenticated user access to be exploited.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/dropbear ssh project
- canonical/dropbear ssh
- version/dropbear ssh/0.52
- version/dropbear ssh/2012.54
- vendor/debian
- canonical/debian linux
- version/debian linux/6.0
- version/debian linux/7.0