Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 405607 (CVE-2012-0920) - <net-misc/dropbear-2012.55 SSH server use-after-free vulnerability (CVE-2012-0920)
Summary: <net-misc/dropbear-2012.55 SSH server use-after-free vulnerability (CVE-2012-...
Status: RESOLVED FIXED
Alias: CVE-2012-0920
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Security
URL: http://seclists.org/fulldisclosure/20...
Whiteboard: B1 [glsa]
Keywords:
Depends on:
Blocks: 328409
  Show dependency tree
 
Reported: 2012-02-24 15:46 UTC by Michael Harrison
Modified: 2013-09-27 00:13 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Harrison 2012-02-24 15:46:51 UTC
This vulnerability is located within the Dropbear daemon and occurs due
to the way the server manages channels concurrency. A specially crafted
request can trigger a `use after free` condition which can be used to
execute arbitrary code under root privileges provided the user has been
authenticated using a public key (authorized_keys file) and a command
restriction is enforced (command option).

Solution:
Upgrade to 2012.55

Changelog:
https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749
https://secure.ucc.asn.au/hg/dropbear/rev/c015af8a71cf

Disclosure Timeline:
2012-01-24 - Vulnerability reported to vendor.
2012-02-24 - Coordinated public release of advisory.
Comment 1 SpanKY gentoo-dev 2012-02-25 00:47:01 UTC
in the tree
Comment 2 Tim Sammut (RETIRED) gentoo-dev 2012-02-25 00:54:34 UTC
Thanks muchly.

Arches, please test and mark stable:
=net-misc/dropbear-2012.55
Target keywords : "alpha amd64 arm hppa ia64 m68k ppc ppc64 s390 sh sparc x86"
Comment 3 Jeroen Roovers gentoo-dev 2012-02-25 15:51:19 UTC
Is sys-libs/zlib-1.2.5.1-r2 good to go stable?
sys-libs/zlib-1.2.6 might be too new.
Comment 4 Agostino Sarubbo gentoo-dev 2012-02-26 14:52:48 UTC
@base-system:

Can you respond to jer's question?
Comment 5 SpanKY gentoo-dev 2012-02-26 17:39:09 UTC
i rewrote the dep to not require newer zlib
http://sources.gentoo.org/net-misc/dropbear/dropbear-2012.55.ebuild?r1=1.1&r2=1.2
Comment 6 Jeroen Roovers gentoo-dev 2012-02-27 03:59:53 UTC
Stable for HPPA.
Comment 7 Brent Baude (RETIRED) gentoo-dev 2012-02-28 20:25:33 UTC
ppc done
Comment 8 Agostino Sarubbo gentoo-dev 2012-02-29 14:25:43 UTC
amd64 stable
Comment 9 Jeff (JD) Horelick (RETIRED) gentoo-dev 2012-02-29 21:10:03 UTC
x86 stable
Comment 10 Tobias Klausmann gentoo-dev 2012-03-02 13:43:49 UTC
Stable on alpha.
Comment 11 Brent Baude (RETIRED) gentoo-dev 2012-03-03 14:38:34 UTC
ppc64 done
Comment 12 Raúl Porcel (RETIRED) gentoo-dev 2012-03-03 20:22:15 UTC
arm/ia64/m68k/s390/sh/sparc stable
Comment 13 Tim Sammut (RETIRED) gentoo-dev 2012-03-03 20:26:36 UTC
Thanks, everyone GLSA request filed.
Comment 14 GLSAMaker/CVETool Bot gentoo-dev 2012-06-15 19:01:55 UTC
CVE-2012-0920 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0920):
  Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54,
  when command restriction and public key authentication are enabled, allows
  remote authenticated users to execute arbitrary code and bypass command
  restrictions via multiple crafted command requests, related to "channels
  concurrency."
Comment 15 GLSAMaker/CVETool Bot gentoo-dev 2013-09-27 00:13:41 UTC
This issue was resolved and addressed in
 GLSA 201309-20 at http://security.gentoo.org/glsa/glsa-201309-20.xml
by GLSA coordinator Chris Reffett (creffett).