CVE-2012-0920: Use After Free
Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54, when command restriction and public key authentication are enabled, allows remote authenticated users to execute arbitrary code and bypass command restrictions via multiple crafted command requests, related to "channels concurrency."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0920?
CVE-2012-0920 is considered to be a high severity vulnerability due to its ability to allow remote authenticated users to execute arbitrary code.
How do I fix CVE-2012-0920?
To fix CVE-2012-0920, upgrade to Dropbear SSH Server version 2012.55 or later.
Which software is affected by CVE-2012-0920?
CVE-2012-0920 affects Dropbear SSH Server versions 0.52 through 2012.54 and Debian GNU/Linux versions 6.0 and 7.0.
What types of attacks are possible with CVE-2012-0920?
CVE-2012-0920 can be exploited to bypass command restrictions and execute arbitrary code.
Is user authentication required to exploit CVE-2012-0920?
Yes, CVE-2012-0920 requires remote authenticated user access to be exploited.