CVE-2019-7283: High severity netkit vulnerability
An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned. A malicious rsh server (or Man-in-The-Middle attacker) can overwrite arbitrary files in a directory on the rcp client machine. This is similar to CVE-2019-6111.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7283?
CVE-2019-7283 is rated as a moderate severity vulnerability that could lead to unauthorized file overwrites.
How do I fix CVE-2019-7283?
To fix CVE-2019-7283, ensure that you update to the latest version of NetKit beyond 0.17 where this vulnerability has been addressed.
Who is affected by CVE-2019-7283?
CVE-2019-7283 affects versions of NetKit up to 0.17 and Debian GNU/Linux version 9.0.
What does CVE-2019-7283 allow an attacker to do?
CVE-2019-7283 allows an attacker to exploit the vulnerability through a malicious rsh server to overwrite files on the client side.
Is CVE-2019-7283 a type of Man-in-The-Middle attack?
Yes, CVE-2019-7283 can be exploited by a Man-in-The-Middle attacker to manipulate files during an rcp operation.