"This vulnerability is located within the Dropbear daemon and occurs due
to the way the server manages channels concurrency. A specially crafted
request can trigger a use after free
condition which can be used to
execute arbitrary code under root privileges provided the user has been
authenticated using a public key (authorized_keys file) and a command
restriction is enforced (command option).
Solution: Upgrade to version 2012.55 or higher."
http://seclists.org/fulldisclosure/2012/Feb/403
Mercurial entry for the upgraded code: https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749
So does this means that I have to upgrade every dropbear on all my OpenWRT routers? What OpenWRT versions are affected??
Please help, it looks like an ASAP task!