CVE-2012-0920 — Dropbear vulnerability

CWE-3997 documents5 sources
Severity
7.1HIGHNVD
EPSS
1.8%
top 17.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Dropbear SSH Project Dropbear SSHDebian DropbearDebian Linux
Timeline
PublishedJun 5
Latest updateMay 14

Description

Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54, when command restriction and public key authentication are enabled, allows remote authenticated users to execute arbitrary code and bypass command restrictions via multiple crafted command requests, related to "channels concurrency."

CVSS vector

AV:N/AC:H/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages3 packages

▶debiandebian/dropbear< dropbear 2012.55-1 (bookworm)
▶Debiandropbear_ssh_project/dropbear_ssh< 2012.55-1+3
▶NVDdropbear_ssh_project/dropbear_ssh0.52 — 2012.54

Also affects: Debian Linux 6.0, 7.0

🔴Vulnerability Details

2
GHSA
GHSA-hw56-hwpj-4432: Use-after-free vulnerability in Dropbear SSH Server 0↗2022-05-14
▶
OSV
CVE-2012-0920: Use-after-free vulnerability in Dropbear SSH Server 0↗2012-06-05
▶

📋Vendor Advisories

1
Debian
CVE-2012-0920: dropbear - Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54, when c...↗2012
▶

💬Community

3
Bugzilla
CVE-2012-0920 dropbear: use-after-free vulnerability↗2012-03-06
▶
Bugzilla
CVE-2012-0920 dropbear: use-after-free vulnerability [epel-6]↗2012-03-06
▶
Bugzilla
CVE-2012-0920 dropbear: use-after-free vulnerability [fedora-all]↗2012-03-06
▶