PT-2012-1171 · Dropbear · Dropbear Ssh Server
Danny Fullerton
·
Publicado
2012-06-05
·
Atualizado
2018-10-30
·
CVE-2012-0920
CVSS v2.0
7.1
Alta
| Vetor | AV:N/AC:H/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Dropbear SSH Server versions 0.52 through 2012.54
Description
The issue allows remote authenticated users to execute arbitrary code and bypass command restrictions via multiple crafted command requests, related to channels concurrency. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out remotely by an attacker who has passed the authentication procedure.
Recommendations
For Dropbear SSH Server versions 0.52 through 2012.54, update to version 2012.55 or later to resolve the issue.
As a temporary workaround, consider disabling public key authentication and command restriction until a patch is available.
Restrict access to the SSH server to minimize the risk of exploitation.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Dropbear Ssh Server