Vulnerability CVE-2019-6111


Published: 2019-01-31

Description:
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).

See advisories in our WLB2 database:
Topic
Author
Date
Med.
SCP Server Verification Issues
Harry Sintonen
16.01.2019
Low
SSHtranger Things SCP Client File Issue
Mark E. Haase
19.01.2019

Type:

CWE-20

(Improper Input Validation)

Vendor: Debian
Product: Debian linux 
Version: 9.0; 8.0;
Vendor: Openbsd
Product: Openssh 
Version: 7.9;
Vendor: Redhat
Product: Enterprise linux 
Version: 7.0;
Vendor: Winscp
Product: Winscp 
Version: 5.1.3;
Vendor: Canonical
Product: Ubuntu linux 
Version:
18.10
18.04
16.04
14.04

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.8/10
4.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Partial

 References:
http://www.openwall.com/lists/oss-security/2019/04/18/1
http://www.securityfocus.com/bid/106741
https://bugzilla.redhat.com/show_bug.cgi?id=1677794
https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c
https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/
https://security.gentoo.org/glsa/201903-16
https://security.netapp.com/advisory/ntap-20190213-0001/
https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
https://usn.ubuntu.com/3885-1/
https://usn.ubuntu.com/3885-2/
https://www.debian.org/security/2019/dsa-4387
https://www.exploit-db.com/exploits/46193/

Related CVE
CVE-2019-2201
In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. U...
CVE-2013-1429
Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks.
CVE-2019-17134
Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via sim...
CVE-2019-17266
libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding with a memcpy.
CVE-2019-16866
Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule.
CVE-2019-16928
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
CVE-2019-14835
A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descript...
CVE-2019-10197
A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared ...

Copyright 2019, cxsecurity.com

 

Back to Top