Published: 31/01/2019 Updated: 07/11/2023

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.9 | Impact Score: 3.6 | Exploitability Score: 2.2

VMScore: 591

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P

An issue exists in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).

Vulnerable Product	Search on Vulmon	Subscribe to Product
openbsd openssh
winscp winscp
canonical ubuntu linux 16.04
canonical ubuntu linux 14.04
canonical ubuntu linux 18.04
canonical ubuntu linux 18.10
debian debian linux 8.0
debian debian linux 9.0
redhat enterprise linux 7.0
redhat enterprise linux 8.0
redhat enterprise linux eus 8.1
redhat enterprise linux eus 8.2
redhat enterprise linux server tus 8.2
redhat enterprise linux server aus 8.2
redhat enterprise linux server tus 8.4
redhat enterprise linux eus 8.4
redhat enterprise linux server aus 8.4
redhat enterprise linux server aus 8.6
redhat enterprise linux server tus 8.6
redhat enterprise linux eus 8.6
fedoraproject fedora 30
apache mina sshd 2.2.0
freebsd freebsd 12.0
freebsd freebsd
fujitsu m10-1_firmware
fujitsu m10-4_firmware
fujitsu m10-4s_firmware
fujitsu m12-1_firmware
fujitsu m12-2_firmware
fujitsu m12-2s_firmware
siemens scalance_x204rna_firmware
siemens scalance_x204rna_eec_firmware

Synopsis Moderate: openssh security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for openssh is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring Sy ...

One of the fixes in USN-3885-1 was incomplete ...

Several security issues were fixed in OpenSSH ...

Debian Bug report logs - #923486 CVE-2019-6111 not fixed, file transfer of unwanted files by malicious SSH server still possible Package: src:openssh; Maintainer for src:openssh is Debian OpenSSH Maintainers <debian-ssh@listsdebianorg>; Reported by: Mike Gabriel <sunweaver@debianorg> Date: Thu, 28 Feb 2019 20:57:02 ...

Debian Bug report logs - #919101 openssh: CVE-2018-20685: scpc in the scp client allows remote SSH servers to bypass intended access restrictions Package: src:openssh; Maintainer for src:openssh is Debian OpenSSH Maintainers <debian-ssh@listsdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sa ...

Debian Bug report logs - #920486 netkit-rsh: CVE-2019-7282 CVE-2019-7283 Package: rsh-client; Maintainer for rsh-client is Alberto Gonzalez Iniesta <agi@inittaborg>; Source for rsh-client is src:netkit-rsh (PTS, buildd, popcon) Reported by: Hiroyuki YAMAMORI <h-yamamo@db3so-netnejp> Date: Sat, 26 Jan 2019 05:24:0 ...

Debian Bug report logs - #793412 openssh-client: scp can send arbitrary control characters / escape sequences to the terminal (CVE-2019-6109) Package: openssh-client; Maintainer for openssh-client is Debian OpenSSH Maintainers <debian-ssh@listsdebianorg>; Source for openssh-client is src:openssh (PTS, buildd, popcon) Repor ...

An issue was discovered in OpenSSH 79 Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, eg, by using ANSI control codes to hide additional files being transferred This affects refresh_progress_meter() in progressmeterc ...

An issue was discovered in OpenSSH Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented) A malicious scp server (or Man-in-The-Middle attacker ...

An issue was discovered in OpenSSH 79 Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented) A malicious scp server (or Man-in-The-Middle atta ...

Critical Infrastructure Sectors: Critical Manufacturing

SCP clients have an issue where additional files can be copied over without your knowledge ...

# Exploit Title: SSHtranger Things # Date: 2019-01-17 # Exploit Author: Mark E Haase <mhaase@hyperiongraycom> # Vendor Homepage: wwwopensshcom/ # Software Link: [download link if available] # Version: OpenSSH 76p1 # Tested on: Ubuntu 18041 LTS # CVE : CVE-2019-6111, CVE-2019-6110 ''' Title: SSHtranger Things Author: Mar ...

''' Title: SSHtranger Things Author: Mark E Haase <mhaase@hyperiongraycom> Homepage: wwwhyperiongraycom Date: 2019-01-17 CVE: CVE-2019-6111, CVE-2019-6110 Advisory: sintonenfi/advisories/scp-client-multiple-vulnerabilitiestxt Tested on: Ubuntu 18041 LTS, OpenSSH client 76p1 We have nicknamed this ...

Linux Restricted Shell Breakout & privilege escalation on Direct Admin using OpenSSH, CPAN shell and FileZilla.

Linux Restricted Shell Breakout & privilege escalation on Direct Admin using OpenSSH, CPAN shell and FileZilla Leveraging CPAN shell to change installation directory: o conf commit makepl_perl INSTALL_BASE='/home/nelaar/perl' o conf commit mbuildpl_perl --install_base='/home/nelaar/perl' o conf commit o conf commit makepl_PERL5LIB INSTALL_BASE='

I've published these rpms to help all sysadmin (for CentoOS/Linux 7x, and RedHat 7x) to solve this CVE: nvdnistgov/vuln/detail/CVE-2019-6111 In my env "CentOS Linux release 792009 (Core)" after installation i've to run this command: chmod 600 /etc/ssh/*_key to start sshd The dir OpenSSH-RPM contain a yum repo and all packages are signed with m

School project for the course "Cybersecurity & Virtualisation" (CSV) at Ghent University of Applied Sciences and Arts.

CSV-NPE2223 This repository contains files related to a school project for the course "Cybersecurity & Virtualisation" (CSV) at Ghent University of Applied Sciences and Arts Description The objective of this project was to identify and exploit a vulnerability within a software package that can be installed on a Debian virtual machine (VM) The first step invo

Oh, SSH, IT please see this: Malicious servers can fsck with your PC's files during scp slurps

The Register • Shaun Nichols in San Francisco • 15 Jan 2019

Data transfer tools caught not checking what exactly they're downloading

A decades-old oversight in the design of Secure Copy Protocol (SCP) tools can be exploited by malicious servers to unexpectedly alter victims' files on their client machines, it has emerged. F-Secure's Harry Sintonen discovered a set of five CVE-listed vulnerabilities, which can be abused by evil servers to overwrite arbitrary files on a computer connected via SCP. If you use a vulnerable version of OpenSSH's scp, PuTTY's PSCP, or WinSCP, to securely transfer files from a remote server, that ser...

CVE-2019-6111

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Exploits

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect