IM
IronMonkey Threat Research

CVE-2019-6111 MEDIUM

Published: 2019-01-31 | Last Modified: 2026-06-17 | Status: Modified

Description

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).

Additional Descriptions (1)

Se ha descubierto un problema en OpenSSH 7.9. Debido a que la implementación de SCP deriva del rcp 1983, el servidor elige qué archivos/directorios se están enviando al cliente. Sin embargo, el cliente scp solo realiza la validación superficial del nombre de objeto devuelto (solo se evitan los ataques de salto de directorio). Un servidor scp malicioso (o atacante Man-in-the-Middle) puede sobrescribir archivos arbitrarios en el directorio objetivo del cliente scp. Si se realiza la operación recursiva (-r), el servidor también puede manipular subdirectorios (por ejemplo, para sobrescribir el archivo .ssh/authorized_keys)

CVSS Metrics

Base Score: 5.9 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactHIGH
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 2.2

Impact Score: 3.6

Base Score: 5.8 (MEDIUM)

AV:N/AC:M/Au:N/C:N/I:P/A:P

Access VectorNETWORK
Access ComplexityMEDIUM
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactPARTIAL
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 4.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-22
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-22

Affected Products

Vendor Product Version Update Type
openbsd openssh * <built-in method update of dict object at 0x7fd369a31540> Application
winscp winscp * <built-in method update of dict object at 0x7fd369a32d80> Application
canonical ubuntu_linux 14.04 <built-in method update of dict object at 0x7fd38677e240> Operating System
canonical ubuntu_linux 16.04 <built-in method update of dict object at 0x7fd36afa7240> Operating System
canonical ubuntu_linux 18.04 <built-in method update of dict object at 0x7fd369a32d40> Operating System
canonical ubuntu_linux 18.10 <built-in method update of dict object at 0x7fd369a33780> Operating System
debian debian_linux 8.0 <built-in method update of dict object at 0x7fd36945eb40> Operating System
debian debian_linux 9.0 <built-in method update of dict object at 0x7fd340813780> Operating System
redhat enterprise_linux 7.0 <built-in method update of dict object at 0x7fd340890200> Operating System
redhat enterprise_linux 8.0 <built-in method update of dict object at 0x7fd369a32380> Operating System
redhat enterprise_linux_eus 8.1 <built-in method update of dict object at 0x7fd369c0e1c0> Operating System
redhat enterprise_linux_eus 8.2 <built-in method update of dict object at 0x7fd369a33dc0> Operating System
redhat enterprise_linux_eus 8.4 <built-in method update of dict object at 0x7fd2905c2580> Operating System
redhat enterprise_linux_eus 8.6 <built-in method update of dict object at 0x7fd3686d36c0> Operating System
redhat enterprise_linux_server_aus 8.2 <built-in method update of dict object at 0x7fd369a30300> Operating System
redhat enterprise_linux_server_aus 8.4 <built-in method update of dict object at 0x7fd369c0ff80> Operating System
redhat enterprise_linux_server_aus 8.6 <built-in method update of dict object at 0x7fd39c444840> Operating System
redhat enterprise_linux_server_tus 8.2 <built-in method update of dict object at 0x7fd369a33d00> Operating System
redhat enterprise_linux_server_tus 8.4 <built-in method update of dict object at 0x7fd36945ebc0> Operating System
redhat enterprise_linux_server_tus 8.6 <built-in method update of dict object at 0x7fd36afa7200> Operating System
fedoraproject fedora 30 <built-in method update of dict object at 0x7fd369c0d640> Operating System
apache mina_sshd 2.2.0 <built-in method update of dict object at 0x7fd36945e580> Application
freebsd freebsd * <built-in method update of dict object at 0x7fd2905c3b80> Operating System
freebsd freebsd 12.0 <built-in method update of dict object at 0x7fd36afa61c0> Operating System
freebsd freebsd 12.0 <built-in method update of dict object at 0x7fd39c4e6640> Operating System
freebsd freebsd 12.0 <built-in method update of dict object at 0x7fd36945f9c0> Operating System
freebsd freebsd 12.0 <built-in method update of dict object at 0x7fd36945e700> Operating System
fujitsu m10-1_firmware * <built-in method update of dict object at 0x7fd38677c780> Operating System
fujitsu m10-4_firmware * <built-in method update of dict object at 0x7fd36afa5e80> Operating System
fujitsu m10-4s_firmware * <built-in method update of dict object at 0x7fd36b3fb040> Operating System
fujitsu m12-1_firmware * <built-in method update of dict object at 0x7fd36948c480> Operating System
fujitsu m12-2_firmware * <built-in method update of dict object at 0x7fd36afa7700> Operating System
fujitsu m12-2s_firmware * <built-in method update of dict object at 0x7fd369a32780> Operating System
fujitsu m10-1_firmware * <built-in method update of dict object at 0x7fd39c447980> Operating System
fujitsu m10-4_firmware * <built-in method update of dict object at 0x7fd369a33a00> Operating System
fujitsu m10-4s_firmware * <built-in method update of dict object at 0x7fd39c4e65c0> Operating System
fujitsu m12-1_firmware * <built-in method update of dict object at 0x7fd36a68b000> Operating System
fujitsu m12-2_firmware * <built-in method update of dict object at 0x7fd369a33c40> Operating System
fujitsu m12-2s_firmware * <built-in method update of dict object at 0x7fd368634100> Operating System
siemens scalance_x204rna_firmware * <built-in method update of dict object at 0x7fd3686c0f80> Operating System
siemens scalance_x204rna_eec_firmware * <built-in method update of dict object at 0x7fd369f73700> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:apache:mina_sshd:2.2.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.0:-:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.0:p1:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.0:p2:*:*:*:*:*:*
Yes cpe:2.3:o:freebsd:freebsd:12.0:p3:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:fujitsu:m10-1:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:fujitsu:m10-4:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:fujitsu:m10-4s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fujitsu:m12-1_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:fujitsu:m12-1:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fujitsu:m12-2_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:fujitsu:m12-2:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fujitsu:m12-2s_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:fujitsu:m12-2s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:fujitsu:m10-1:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:fujitsu:m10-4:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:fujitsu:m10-4s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fujitsu:m12-1_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:fujitsu:m12-1:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fujitsu:m12-2_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:fujitsu:m12-2:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fujitsu:m12-2s_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:fujitsu:m12-2s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:scalance_x204rna_eec_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:scalance_x204rna_eec:-:*:*:*:*:*:*:*

References