5.9
Moyenne
CVE-2019-6111 An issue was discovered in OpenSSH 7.9
Description
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| n/a | Versions non publiées | |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
Références
- DSA-4387 www.debian.org
- security.netapp.com security.netapp.com
- 106741 www.securityfocus.com
- cvsweb.openbsd.org cvsweb.openbsd.org
- USN-3885-1 usn.ubuntu.com
- USN-3885-2 usn.ubuntu.com
- bugzilla.redhat.com bugzilla.redhat.com
- sintonen.fi sintonen.fi
- 46193 www.exploit-db.com
- GLSA-201903-16 security.gentoo.org
- [debian-lts-announce] 20190325 [SECURITY] [DLA 1728-1] openssh security update lists.debian.org
- [oss-security] 20190417 Announce: OpenSSH 8.0 released www.openwall.com
- FEDORA-2019-0f4190cdb0 lists.fedoraproject.org
- [mina-dev] 20190620 [jira] [Created] (SSHD-925) See if SCP vulnerability CVE-2019-6111 applies and mitigate it if so lists.apache.org
- [mina-dev] 20190623 [jira] [Comment Edited] (SSHD-925) See if SCP vulnerability CVE-2019-6111 applies and mitigate it if so lists.apache.org
- [mina-dev] 20190623 [jira] [Commented] (SSHD-925) See if SCP vulnerability CVE-2019-6111 applies and mitigate it if so lists.apache.org
- openSUSE-SU-2019:1602 lists.opensuse.org
- FreeBSD-EN-19:10 www.freebsd.org
- [mina-dev] 20190820 [jira] [Resolved] (SSHD-925) See if SCP vulnerability CVE-2019-6111 applies and mitigate it if so lists.apache.org
- www.oracle.com www.oracle.com
- RHSA-2019:3702 access.redhat.com
- [oss-security] 20220802 CVE-2022-29154: Rsync client-side arbitrary file write vulnerability. www.openwall.com
- cert-portal.siemens.com cert-portal.siemens.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de n/a
Les 144658 CVE de n/a →
CVE-2026-106713
An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the…
Non notée
CVE-2026-106715
NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin…
Non notée
CVE-2026-106714
Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it…
Non notée
CVE-2026-106716
ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep…
Non notée