Dropbear SSH Server Use-After-Free Lets Remote Authenticated Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1026743 |
|
SecurityTracker URL: http://securitytracker.com/id/1026743
|
|
CVE Reference:
CVE-2012-0920
(Links to External Site)
|
Date: Feb 27 2012
|
Impact:
Execution of arbitrary code via network, Root access via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 0.52 - 2012.55
|
Description:
A vulnerability was reported in Dropbear SSH Server. A remote authenticated user can execute arbitrary code on the target system.
On systems where command="..." authorized_keys restrictions are used, a remote authenticated user can send a specially crafted request to trigger a use-after-free memory error and bypass the command restriction or execute arbitrary code with root privileges.
The vendor was notified on January 24, 2012.
Danny Fullerton of Mantor Organization reported this vulnerability.
|
Impact:
A remote authenticated user can execute arbitrary code on the target system.
|
Solution:
The vendor has issued a fix (2012.55).
The vendor's advisory is available at:
http://matt.ucc.asn.au/dropbear/CHANGES
|
Vendor URL: matt.ucc.asn.au/dropbear/CHANGES (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
Linux (Any), UNIX (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Fri, 24 Feb 2012 07:53:15 -0500
Subject: Dropbear SSH server use-after-free vulnerability
|
Dropbear SSH server use-after-free vulnerability
Impact: A remote authenticated user can execute arbitrary code on the
target system.
Class: Use After Free - CWE-416
CVE ID: CVE-2012-0920
CVSS: 8.5 (AV:N/AC:M/AU:S/C:C/I:C/A:C)
Description:
This vulnerability is located within the Dropbear daemon and occurs due
to the way the server manages channels concurrency. A specially crafted
request can trigger a `use after free` condition which can be used to
execute arbitrary code under root privileges provided the user has been
authenticated using a public key (authorized_keys file) and a command
restriction is enforced (command option).
Solution: Upgrade to version 2012.55 or higher.
Reference: https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749
Disclosure Timeline:
2012-01-24 - Vulnerability reported to vendor.
2012-02-24 - Coordinated public release of advisory.
Credit:
This vulnerability was discovered by Danny Fullerton from Mantor
Organization.
Special thanks to Matt.
|
|
