CVE-2019-6111

Description

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).

Weakness classification

• nvd@nist.gov: CWE-22
• 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-22

Primary references

• cve@mitre.org — Broken Link
• cve@mitre.org — Mailing List, Third Party Advisory
• cve@mitre.org — Mailing List, Third Party Advisory
• cve@mitre.org — Broken Link, Third Party Advisory, VDB Entry
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Exploit, Issue Tracking, Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Release Notes
• cve@mitre.org
• cve@mitre.org
• cve@mitre.org
• cve@mitre.org