CVE-2019-6111Medium· 5.9▾ TwilightPoC availableAn issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 32.5 · likelihood 11.6 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
58%
Exploit-DB · 2 GitHub repos (last check)
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
openssh <= 7.9winscp <= 5.1.3ubuntu_linux = 14.04ubuntu_linux = 16.04ubuntu_linux = 18.04ubuntu_linux = 18.10debian_linux = 8.0debian_linux = 9.0enterprise_linux = 7.0enterprise_linux = 8.0enterprise_linux_eus = 8.1enterprise_linux_eus = 8.2enterprise_linux_eus = 8.4enterprise_linux_eus = 8.6enterprise_linux_server_aus = 8.2enterprise_linux_server_aus = 8.4enterprise_linux_server_aus = 8.6enterprise_linux_server_tus = 8.2enterprise_linux_server_tus = 8.4enterprise_linux_server_tus = 8.6fedora = 30mina_sshd = 2.2.0freebsd < 12.0freebsd = 12.0m10-1_firmware < xcp2361m10-4_firmware < xcp2361m10-4s_firmware < xcp2361m12-1_firmware < xcp2361m12-2_firmware < xcp2361m12-2s_firmware < xcp2361m10-1_firmware < xcp3070m10-4_firmware < xcp3070m10-4s_firmware < xcp3070m12-1_firmware < xcp3070m12-2_firmware < xcp3070m12-2s_firmware < xcp3070scalance_x204rna_firmware < 3.2.7scalance_x204rna_eec_firmware < 3.2.7Upgrade past the affected range:
freebsd 12.0m10-1_firmware xcp3070m10-4_firmware xcp3070m10-4s_firmware xcp3070m12-1_firmware xcp3070m12-2_firmware xcp3070m12-2s_firmware xcp3070scalance_x204rna_firmware 3.2.7scalance_x204rna_eec_firmware 3.2.7Connected by shared product, vendor, weakness, or advisory.
CVE-2019-6110Medium· 6.8In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files …
CVE-2019-16905High· 7.8OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key
CVE-2019-6109Medium· 6.8An issue was discovered in OpenSSH 7.9
CVE-2020-15778High· 7.4scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument
CVE-2020-14145Medium· 5.9The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation
CVE-2020-12062High· 7.5The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download di…