Description
Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54, when command restriction and public key authentication are enabled, allows remote authenticated users to execute arbitrary code and bypass command restrictions via multiple crafted command requests, related to "channels concurrency."
Metrics
CVSS 2.0 7.1/10
AV:N/AC:H/Au:S/C:C/I:C/A:CWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://matt.ucc.asn.au/dropbear/CHANGESVendor Advisory
- http://secunia.com/advisories/48147Third Party Advisory
- http://secunia.com/advisories/48929Third Party Advisory
- http://www.debian.org/security/2012/dsa-2456Third Party Advisory
- http://www.osvdb.org/79590Broken Link
- http://www.securityfocus.com/bid/52159Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73444Third Party Advisory, VDB Entry
- https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749Vendor Advisory
- https://www.mantor.org/~northox/misc/CVE-2012-0920.htmlThird Party Advisory
- http://matt.ucc.asn.au/dropbear/CHANGESVendor Advisory
- http://secunia.com/advisories/48147Third Party Advisory
- http://secunia.com/advisories/48929Third Party Advisory
- http://www.debian.org/security/2012/dsa-2456Third Party Advisory
- http://www.osvdb.org/79590Broken Link
- http://www.securityfocus.com/bid/52159Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73444Third Party Advisory, VDB Entry
- https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749Vendor Advisory
- https://www.mantor.org/~northox/misc/CVE-2012-0920.htmlThird Party Advisory
Timeline
- Published
- Jun 5, 2012
- Last modified
- Jun 16, 2026
- NVD status
- Modified