CVE-2005-4178

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-12-12 · updated 2026-06-16

Description

Buffer overflow in Dropbear server before 0.47 allows authenticated users to execute arbitrary code via unspecified inputs that cause insufficient memory to be allocated due to an incorrect expression that does not enforce the proper order of operations.

Affected products

Debian Linux: 3.0, 3.1
[UNKNOWN] dropbear: before 0.47 — fixed in 0.47

How to fix

Upgrade to a fixed version: [UNKNOWN] dropbear 0.47. Check the vendor advisory for mitigations.

References

http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2005q4/000312.html
http://matt.ucc.asn.au/dropbear/dropbear.html
http://secunia.com/advisories/18108
http://secunia.com/advisories/18109
http://secunia.com/advisories/18142
http://www.debian.org/security/2005/dsa-923
http://www.gentoo.org/security/en/glsa/glsa-200512-13.xml
http://www.securityfocus.com/bid/15923/
http://www.vupen.com/english/advisories/2005/2962
http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2005q4/000312.html
http://matt.ucc.asn.au/dropbear/dropbear.html
http://secunia.com/advisories/18108

Get alerted when CVE-2005-4178 or the next vulnerability affects your stack