Dropbear SSH Server Channel Concurrency Use-after-free Remote Code Execution

high Nessus Plugin ID 58183

Language:

Synopsis

The remote host is affected by a remote code execution vulnerability.

Description

According to its self-reported banner, the remote host is running a version of Dropbear SSH before 2012.55. As such, it reportedly contains a flaw that might allow an attacker to run arbitrary code on the remote host with root privileges if they are authenticated using a public key and command restriction is enforced.

Note that Nessus has not tried to exploit this vulnerability but instead has relied solely on the version in the service's banner.

Note also, in cases where the host is running ESXi 4.0 or ESXi 4.1, VMware states in their KB article id 2037316 that this is a false positive since administrative access is required to login via SSH so there are no privileges to be gained by exploiting this issue. That is true only in a default setup, not one in which SSH access has been enabled for non-root users.

Solution

Upgrade to the Dropbear SSH 2012.55 or later.

Plugin Details

Severity: High

ID: 58183

File Name: dropbear_ssh_55.nasl

Version: 1.8

Type: remote

Family: Misc.

Published: 3/1/2012

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:matt_johnston:dropbear_ssh_server

Exploit Ease: No known exploits are available

Patch Publication Date: 2/24/2012

Vulnerability Publication Date: 2/24/2012

Reference Information

CVE: CVE-2012-0920

BID: 52159

Detections

Analytics