An issue exists in rcp in NetKit up to and including 0.17. For an rcp operation, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned. A malicious rsh server (or Man-in-The-Middle attacker) can overwrite arbitrary files in a directory on the rcp client machine. This is similar to CVE-2019-6111.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
netkit netkit |
||
debian debian linux 9.0 |