← back
CVE-2019-6111

CVE-2019-6111

CVSS 5.9 MEDIUMEPSS 58.2%CWE-22
Vexday Risk Score
45Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 5.9EPSS 58.2%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado
Lifecycle
11 Jan 2019Public PoC
31 Jan 2019Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
n/a · n/a
public PoCs found — 5
githubgithub.com/53n7hu/SNP★ 4githubgithub.com/mbadanoiu/MAL-008★ 0cve_referencewww.exploit-db.com/exploits/46193/unverifiedexploitdbwww.exploit-db.com/exploits/46516unverifiedexploitdbwww.exploit-db.com/exploits/46193unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.htmlhttps://access.redhat.com/errata/RHSA-2019:3702https://bugzilla.redhat.com/show_bug.cgi?id=1677794https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttps://cvsweb.openbsd.org/src/usr.bin/ssh/scp.chttps://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23%40%3Cdev.mina.apache.org%3Ehttps://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b%40%3Cdev.mina.apache.org%3Ehttps://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a%40%3Cdev.mina.apache.org%3Ehttps://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f%40%3Cdev.mina.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2019/03/msg00030.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/https://security.gentoo.org/glsa/201903-16