CVE-2012-0920

2012-06-0500:00:00

ubuntu.com

7.1 High

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:S/C:C/I:C/A:C

0.01 Low

EPSS

Percentile

83.7%

JSON

Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54,
when command restriction and public key authentication are enabled, allows
remote authenticated users to execute arbitrary code and bypass command
restrictions via multiple crafted command requests, related to “channels
concurrency.”

Bugs

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchdropbear< 0.52-4ubuntu0.10.04.1UNKNOWN
ubuntu11.04noarchdropbear< 0.52-5+squeeze1build0.11.04.1UNKNOWN
ubuntu11.10noarchdropbear< 0.53.1-1ubuntu1.1UNKNOWN
ubuntu12.04noarchdropbear< 2011.54-1ubuntu0.12.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	10.04	noarch	dropbear	< 0.52-4ubuntu0.10.04.1	UNKNOWN
ubuntu	11.04	noarch	dropbear	< 0.52-5+squeeze1build0.11.04.1	UNKNOWN
ubuntu	11.10	noarch	dropbear	< 0.53.1-1ubuntu1.1	UNKNOWN
ubuntu	12.04	noarch	dropbear	< 2011.54-1ubuntu0.12.04.1	UNKNOWN