CVE-2012-0920 needs fixing, server use-after-free

Thank you for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. I see that you have attached patches to update the Ubuntu packages to the new upstream version. While this work is appreciated, we cannot publish your patches because this does not follow Ubuntu's policy of backporting security patches. If you are able, perhaps you could prepare debdiffs to fix this by following https://wiki.ubuntu.com/SecurityUpdateProcedures.

Opps, wrong bug response. Here comes the correct one.

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

natty and precise can be synced from debian

Natty was fake synced from Debian. Precise will need to be patched at this point.

Thanks for the patches! Based on https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Packaging, the lucid update should use 0.52-4ubuntu0.10.04.1 as the version. Oneiric should use a patch name of 0004-Fix-use-after-free-bug-CVE-2012-0920.diff since 0004 already exists. I have adjust both for this and uploaded.

Unsubscribing ubuntu-security-sponsors for now. Please resubscribe when a patch is prepared for precise.

dropbear (0.52-5+squeeze1build0.11.04.1) natty-security; urgency=low

  * fake sync from Debian

dropbear (0.52-5+squeeze1) stable-security; urgency=high

  * debian/diff/0003-Fix-use-after-free-bug-CVE-2012-0920.diff: new:
    Fix use-after-free bug (CVE-2012-0920) (closes: #661150).

This bug was fixed in the package dropbear - 0.53.1-1ubuntu1.1

---------------
dropbear (0.53.1-1ubuntu1.1) oneiric-security; urgency=low

  * SECURITY UPDATE: remote execution via use after free (LP: #976360)
    - debian/diff/0005-Fix-use-after-free-bug-CVE-2012-0920.diff
      pulled from https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749
      Thanks to Matt Johnston
    - CVE-2012-0920
 -- Julian Taylor <email address hidden> Tue, 24 Apr 2012 22:54:41 +0200

This bug was fixed in the package dropbear - 0.52-4ubuntu0.10.04.1

---------------
dropbear (0.52-4ubuntu0.10.04.1) lucid-security; urgency=low

  * SECURITY UPDATE: remote execution via use after free (LP: #976360)
    - debian/diff/0003-Fix-use-after-free-bug-CVE-2012-0920.diff
      backported from https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749
      Thanks to Gerrit Pape
    - CVE-2012-0920
 -- Julian Taylor <email address hidden> Tue, 24 Apr 2012 22:54:41 +0200

Thanks for your patch! Looks good though I renamed 0005-Fix-use-after-free-bug-CVE-2012-0920.diff to 0004-Fix-use-after-free-bug-CVE-2012-0920.diff since there was no 0004* patch in precise. Uploaded.

FYI, I had someone reject the merges since they were against the release version of the package and not -security, but I have uploaded them.

When Quantal opens, feel free to ask for a sync request.

This bug was fixed in the package dropbear - 2011.54-1ubuntu0.12.04.1

---------------
dropbear (2011.54-1ubuntu0.12.04.1) precise-security; urgency=low

  * SECURITY UPDATE: remote execution via use after free (LP: #976360)
    - debian/diff/0004-Fix-use-after-free-bug-CVE-2012-0920.diff
      pulled from https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749
      Thanks to Matt Johnston
    - CVE-2012-0920
 -- Julian Taylor <email address hidden> Tue, 24 Apr 2012 22:54:41 +0200

Unsubscribing ubuntu-security-sponsors since there is nothing to do.

This bug was fixed in the package dropbear - 2012.55-1

---------------
dropbear (2012.55-1) unstable; urgency=high

  * New upstream release.
    * Fix use-after-free bug that could be triggered if command="..."
      authorized_keys restrictions are used. Could allow arbitrary
      code execution or bypass of the command="..." restriction to an
      authenticated user. This bug affects releases 0.52 onwards.
      Ref CVE-2012-0920 (closes: #661150). Thanks to Danny Fullerton
      of Mantor Organization for reporting the bug.

 -- Gerrit Pape <email address hidden> Mon, 27 Feb 2012 14:18:53 +0000