{"api_version":"1","generated_at":"2026-04-22T19:06:12+00:00","cve":"CVE-2012-0920","urls":{"html":"https://cve.report/CVE-2012-0920","api":"https://cve.report/api/cve/CVE-2012-0920.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2012-0920","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-0920"},"summary":{"title":"CVE-2012-0920","description":"Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54, when command restriction and public key authentication are enabled, allows remote authenticated users to execute arbitrary code and bypass command restrictions via multiple crafted command requests, related to \"channels concurrency.\"","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2012-06-05 22:55:00","updated_at":"2018-10-30 16:28:00"},"problem_types":["CWE-399"],"metrics":[],"references":[{"url":"http://www.securityfocus.com/bid/52159","name":"52159","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"Dropbear SSH Server Use After Free Remote Code Execution Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://matt.ucc.asn.au/dropbear/CHANGES","name":"http://matt.ucc.asn.au/dropbear/CHANGES","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/79590","name":"79590","refsource":"OSVDB","tags":["Broken Link"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.mantor.org/~northox/misc/CVE-2012-0920.html","name":"https://www.mantor.org/~northox/misc/CVE-2012-0920.html","refsource":"MISC","tags":["Third Party Advisory"],"title":"CVE-2012-0920 - Dropbear SSH server use-after-free vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://secunia.com/advisories/48147","name":"48147","refsource":"SECUNIA","tags":["Third Party Advisory"],"title":"About Secunia Research | Flexera","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749","name":"https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"dropbear: 818108bf7749","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://secunia.com/advisories/48929","name":"48929","refsource":"SECUNIA","tags":["Third Party Advisory"],"title":"About Secunia Research | Flexera","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2012/dsa-2456","name":"DSA-2456","refsource":"DEBIAN","tags":["Third Party Advisory"],"title":"Debian -- Security Information -- DSA-2456-1 dropbear","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/73444","name":"dropbear-code-execution(73444)","refsource":"XF","tags":["Third Party Advisory","VDB Entry"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-0920","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0920","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2012","cve_id":"920","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"920","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"920","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"920","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"920","vulnerable":"1","versionEndIncluding":"2012.54","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"dropbear_ssh_project","cpe5":"dropbear_ssh","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2012-0920","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54, when command restriction and public key authentication are enabled, allows remote authenticated users to execute arbitrary code and bypass command restrictions via multiple crafted command requests, related to \"channels concurrency.\""}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"dropbear-code-execution(73444)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/73444"},{"name":"48147","refsource":"SECUNIA","url":"http://secunia.com/advisories/48147"},{"name":"DSA-2456","refsource":"DEBIAN","url":"http://www.debian.org/security/2012/dsa-2456"},{"name":"79590","refsource":"OSVDB","url":"http://www.osvdb.org/79590"},{"name":"http://matt.ucc.asn.au/dropbear/CHANGES","refsource":"CONFIRM","url":"http://matt.ucc.asn.au/dropbear/CHANGES"},{"name":"52159","refsource":"BID","url":"http://www.securityfocus.com/bid/52159"},{"name":"https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749","refsource":"CONFIRM","url":"https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749"},{"name":"https://www.mantor.org/~northox/misc/CVE-2012-0920.html","refsource":"MISC","url":"https://www.mantor.org/~northox/misc/CVE-2012-0920.html"},{"name":"48929","refsource":"SECUNIA","url":"http://secunia.com/advisories/48929"}]}},"nvd":{"publishedDate":"2012-06-05 22:55:00","lastModifiedDate":"2018-10-30 16:28:00","problem_types":["CWE-399"],"metrics":{"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:H/Au:S/C:C/I:C/A:C","accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE","baseScore":7.1},"severity":"HIGH","exploitabilityScore":3.9,"impactScore":10,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:dropbear_ssh_project:dropbear_ssh:*:*:*:*:*:*:*:*","versionStartIncluding":"0.52","versionEndIncluding":"2012.54","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2012","CveId":"920","Ordinal":"53573","Title":"CVE-2012-0920","CVE":"CVE-2012-0920","Year":"2012"},"notes":[{"CveYear":"2012","CveId":"920","Ordinal":"1","NoteData":"Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54, when command restriction and public key authentication are enabled, allows remote authenticated users to execute arbitrary code and bypass command restrictions via multiple crafted command requests, related to \"channels concurrency.\"","Type":"Description","Title":null},{"CveYear":"2012","CveId":"920","Ordinal":"2","NoteData":"2012-06-05","Type":"Other","Title":"Published"},{"CveYear":"2012","CveId":"920","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}