An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only perf…
Medium CVSS 5.9
Summary
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirect…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
- :
Sources
- NVD DATABASE
Original Links
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html Broken Link
- http://www.openwall.com/lists/oss-security/2019/04/18/1 Mailing List
- http://www.openwall.com/lists/oss-security/2022/08/02/1 Mailing List
- http://www.securityfocus.com/bid/106741 Broken Link
- https://access.redhat.com/errata/RHSA-2019:3702 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1677794 Exploit
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf Third Party Advisory
- https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c Release Notes
- https://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23%40%3Cdev.mina.apache.org%3E
- https://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b%40%3Cdev.mina.apache.org%3E
- https://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a%40%3Cdev.mina.apache.org%3E
- https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f%40%3Cdev.mina.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/
- https://security.gentoo.org/glsa/201903-16 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190213-0001/ Third Party Advisory
- https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt Third Party Advisory
- https://usn.ubuntu.com/3885-1/ Third Party Advisory
- https://usn.ubuntu.com/3885-2/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4387 Third Party Advisory
- https://www.exploit-db.com/exploits/46193/ Exploit
- https://www.freebsd.org/security/advisories/FreeBSD-EN-19:10.scp.asc Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html Patch
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html Broken Link
- http://www.openwall.com/lists/oss-security/2019/04/18/1 Mailing List
- http://www.openwall.com/lists/oss-security/2022/08/02/1 Mailing List
- http://www.securityfocus.com/bid/106741 Broken Link
- https://access.redhat.com/errata/RHSA-2019:3702 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1677794 Exploit
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf Third Party Advisory
- https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c Release Notes
- https://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23%40%3Cdev.mina.apache.org%3E
- https://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b%40%3Cdev.mina.apache.org%3E
- https://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a%40%3Cdev.mina.apache.org%3E
- https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f%40%3Cdev.mina.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/
- https://security.gentoo.org/glsa/201903-16 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190213-0001/ Third Party Advisory
- https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt Third Party Advisory
- https://usn.ubuntu.com/3885-1/ Third Party Advisory
- https://usn.ubuntu.com/3885-2/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4387 Third Party Advisory
- https://www.exploit-db.com/exploits/46193/ Exploit
- https://www.freebsd.org/security/advisories/FreeBSD-EN-19:10.scp.asc Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html Patch
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-412672.html
Timeline
- nvd_ingest NVD