CVE-2019-6111

Published Jan 31, 2019

Last updated 24 days ago

Overview

Description
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
Source
cve@mitre.org
NVD status
Modified
Products
openssh, winscp, ubuntu_linux, debian_linux, enterprise_linux, enterprise_linux_eus, enterprise_linux_server_aus, enterprise_linux_server_tus, fedora, mina_sshd, freebsd, m10-1_firmware, m10-4_firmware, m10-4s_firmware, m12-1_firmware, m12-2_firmware, m12-2s_firmware, scalance_x204rna_firmware, scalance_x204rna_eec_firmware

Risk scores

CVSS 3.1

Type
Primary
Base score
5.9
Impact score
3.6
Exploitability score
2.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity
MEDIUM

CVSS 2.0

Type
Primary
Base score
5.8
Impact score
4.9
Exploitability score
8.6
Vector string
AV:N/AC:M/Au:N/C:N/I:P/A:P

Weaknesses

nvd@nist.gov
CWE-22
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-22

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.