Vulnerability CVE-2019-6111


Published: 2019-01-31

Description:
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).

See advisories in our WLB2 database:
Topic
Author
Date
Med.
SCP Server Verification Issues
Harry Sintonen
16.01.2019
Low
SSHtranger Things SCP Client File Issue
Mark E. Haase
19.01.2019

Type:

CWE-20

(Improper Input Validation)

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.8/10
4.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Partial
Affected software
Winscp -> Winscp 
Redhat -> Enterprise linux 
Openbsd -> Openssh 
Debian -> Debian linux 
Canonical -> Ubuntu linux 

 References:
http://www.openwall.com/lists/oss-security/2019/04/18/1
http://www.securityfocus.com/bid/106741
https://bugzilla.redhat.com/show_bug.cgi?id=1677794
https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c
https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/
https://security.gentoo.org/glsa/201903-16
https://security.netapp.com/advisory/ntap-20190213-0001/
https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
https://usn.ubuntu.com/3885-1/
https://usn.ubuntu.com/3885-2/
https://www.debian.org/security/2019/dsa-4387
https://www.exploit-db.com/exploits/46193/

Copyright 2020, cxsecurity.com

 

Back to Top