Bug 405607 – <net-misc/dropbear-2012.55 SSH server use-after-free vulnerability (CVE-2012-0920)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Michael Harrison 2012-02-24 15:46:51 UTC]

This vulnerability is located within the Dropbear daemon and occurs due
to the way the server manages channels concurrency. A specially crafted
request can trigger a `use after free` condition which can be used to
execute arbitrary code under root privileges provided the user has been
authenticated using a public key (authorized_keys file) and a command
restriction is enforced (command option).

Solution:
Upgrade to 2012.55

Changelog:
https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749
https://secure.ucc.asn.au/hg/dropbear/rev/c015af8a71cf

Disclosure Timeline:
2012-01-24 - Vulnerability reported to vendor.
2012-02-24 - Coordinated public release of advisory.

[Comment 1 SpanKY 2012-02-25 00:47:01 UTC]

in the tree

[Comment 2 Tim Sammut (RETIRED) 2012-02-25 00:54:34 UTC]

Thanks muchly.

Arches, please test and mark stable:
=net-misc/dropbear-2012.55
Target keywords : "alpha amd64 arm hppa ia64 m68k ppc ppc64 s390 sh sparc x86"

[Comment 3 Jeroen Roovers (RETIRED) 2012-02-25 15:51:19 UTC]

Is sys-libs/zlib-1.2.5.1-r2 good to go stable?
sys-libs/zlib-1.2.6 might be too new.

[Comment 4 Agostino Sarubbo 2012-02-26 14:52:48 UTC]

@base-system:

Can you respond to jer's question?

[Comment 5 SpanKY 2012-02-26 17:39:09 UTC]

i rewrote the dep to not require newer zlib
http://sources.gentoo.org/net-misc/dropbear/dropbear-2012.55.ebuild?r1=1.1&r2=1.2

[Comment 6 Jeroen Roovers (RETIRED) 2012-02-27 03:59:53 UTC]

Stable for HPPA.

[Comment 7 Brent Baude (RETIRED) 2012-02-28 20:25:33 UTC]

ppc done

[Comment 8 Agostino Sarubbo 2012-02-29 14:25:43 UTC]

amd64 stable

[Comment 9 Jeff (JD) Horelick (RETIRED) 2012-02-29 21:10:03 UTC]

x86 stable

[Comment 10 Tobias Klausmann (RETIRED) 2012-03-02 13:43:49 UTC]

Stable on alpha.

[Comment 11 Brent Baude (RETIRED) 2012-03-03 14:38:34 UTC]

ppc64 done

[Comment 12 Raúl Porcel (RETIRED) 2012-03-03 20:22:15 UTC]

arm/ia64/m68k/s390/sh/sparc stable

[Comment 13 Tim Sammut (RETIRED) 2012-03-03 20:26:36 UTC]

Thanks, everyone GLSA request filed.

[Comment 14 GLSAMaker/CVETool Bot 2012-06-15 19:01:55 UTC]

CVE-2012-0920 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0920):
  Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54,
  when command restriction and public key authentication are enabled, allows
  remote authenticated users to execute arbitrary code and bypass command
  restrictions via multiple crafted command requests, related to "channels
  concurrency."

[Comment 15 GLSAMaker/CVETool Bot 2013-09-27 00:13:41 UTC]

This issue was resolved and addressed in
 GLSA 201309-20 at http://security.gentoo.org/glsa/glsa-201309-20.xml
by GLSA coordinator Chris Reffett (creffett).