medium
5.9
CWE
22
Advisory Published
Updated

CVE-2019-6111: Path Traversal

First published: Mon Jan 14 2019(Updated: )

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).

Credit: cve@mitre.org cve@mitre.org

Affected SoftwareAffected VersionHow to fix
ubuntu/openssh<1:7.6
1:7.6
ubuntu/openssh<1:7.7
1:7.7
ubuntu/openssh<1:6.6
1:6.6
ubuntu/openssh<1:7.2
1:7.2
Openbsd Openssh<=7.9
Winscp Winscp<=5.1.3
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=18.10
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Redhat Enterprise Linux=7.0
Redhat Enterprise Linux=8.0
Redhat Enterprise Linux Eus=8.1
Redhat Enterprise Linux Eus=8.2
Redhat Enterprise Linux Eus=8.4
Redhat Enterprise Linux Eus=8.6
Redhat Enterprise Linux Server Aus=8.2
Redhat Enterprise Linux Server Aus=8.4
Redhat Enterprise Linux Server Aus=8.6
Redhat Enterprise Linux Server Tus=8.2
Redhat Enterprise Linux Server Tus=8.4
Redhat Enterprise Linux Server Tus=8.6
Fedoraproject Fedora=30
Apache Mina Sshd=2.2.0
FreeBSD FreeBSD<12.0
FreeBSD FreeBSD=12.0
FreeBSD FreeBSD=12.0-p1
FreeBSD FreeBSD=12.0-p2
FreeBSD FreeBSD=12.0-p3
All of
Fujitsu M10-1 Firmware<xcp2361
Fujitsu M10-1
All of
Fujitsu M10-4 Firmware<xcp2361
Fujitsu M10-4
All of
Fujitsu M10-4s Firmware<xcp2361
Fujitsu M10-4s
All of
Fujitsu M12-1 Firmware<xcp2361
Fujitsu M12-1
All of
Fujitsu M12-2 Firmware<xcp2361
Fujitsu M12-2
All of
Fujitsu M12-2s Firmware<xcp2361
Fujitsu M12-2s
All of
Fujitsu M10-1 Firmware<xcp3070
Fujitsu M10-1
All of
Fujitsu M10-4 Firmware<xcp3070
Fujitsu M10-4
All of
Fujitsu M10-4s Firmware<xcp3070
Fujitsu M10-4s
All of
Fujitsu M12-1 Firmware<xcp3070
Fujitsu M12-1
All of
Fujitsu M12-2 Firmware<xcp3070
Fujitsu M12-2
All of
Fujitsu M12-2s Firmware<xcp3070
Fujitsu M12-2s
All of
Siemens Scalance X204rna Firmware<3.2.7
Siemens Scalance X204rna
All of
Siemens Scalance X204rna Eec Firmware<3.2.7
Siemens Scalance X204rna Eec
Fujitsu M10-1 Firmware<xcp2361
Fujitsu M10-1
Fujitsu M10-4 Firmware<xcp2361
Fujitsu M10-4
Fujitsu M10-4s Firmware<xcp2361
Fujitsu M10-4s
Fujitsu M12-1 Firmware<xcp2361
Fujitsu M12-1
Fujitsu M12-2 Firmware<xcp2361
Fujitsu M12-2
Fujitsu M12-2s Firmware<xcp2361
Fujitsu M12-2s
Fujitsu M10-1 Firmware<xcp3070
Fujitsu M10-4 Firmware<xcp3070
Fujitsu M10-4s Firmware<xcp3070
Fujitsu M12-1 Firmware<xcp3070
Fujitsu M12-2 Firmware<xcp3070
Fujitsu M12-2s Firmware<xcp3070
Siemens Scalance X204rna Firmware<3.2.7
Siemens Scalance X204rna
Siemens Scalance X204rna Eec Firmware<3.2.7
Siemens Scalance X204rna Eec
debian/openssh
1:7.9p1-10+deb10u2
1:7.9p1-10+deb10u4
1:8.4p1-5+deb11u3
1:9.2p1-2+deb12u2
1:9.7p1-5

Remedy

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Remedy

https://github.com/openssh/openssh-portable/commit/391ffc4b9d31fa1f4ad566499fef9176ff8a07dc

Remedy

https://github.com/openssh/openssh-portable/commit/3d896c157c722bc47adca51a58dca859225b5874

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is CVE-2019-6111?

    CVE-2019-6111 is a vulnerability in OpenSSH that allows directory traversal attacks during file transfers using scp.

  • What is the severity of CVE-2019-6111?

    CVE-2019-6111 has a severity score of 5.9, which is considered medium.

  • How does CVE-2019-6111 impact OpenSSH?

    CVE-2019-6111 allows an attacker to potentially overwrite or retrieve arbitrary files on the server through scp file transfers.

  • Which versions of OpenSSH are affected by CVE-2019-6111?

    OpenSSH versions 7.9 and prior are affected by CVE-2019-6111.

  • Is there a fix for CVE-2019-6111?

    Yes, updating to OpenSSH version 7.9p1-10+deb10u2 or later will fix the vulnerability.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203