REDHAT-BUG-1666127: Medium severity OpenSSH OpenSSH vulnerability
OpenSSH has a vulnerability in the scp client utility. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, scp client only perform cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example overwrite .ssh/authorizedkeys).
External Reference:
https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
Proposed Patch:
https://sintonen.fi/advisories/scp-name-validator.patch
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1666127?
The severity of REDHAT-BUG-1666127 is classified as high due to the potential for unauthorized file access.
How do I fix REDHAT-BUG-1666127?
To fix REDHAT-BUG-1666127, update your OpenSSH installation to a version that includes the security patch addressing this vulnerability.
What software is affected by REDHAT-BUG-1666127?
REDHAT-BUG-1666127 affects the OpenSSH scp client utility.
Can REDHAT-BUG-1666127 lead to a security breach?
Yes, REDHAT-BUG-1666127 can lead to a security breach through potential directory traversal vulnerabilities.
Is it possible to mitigate risks from REDHAT-BUG-1666127?
Yes, users can mitigate risks from REDHAT-BUG-1666127 by implementing strict user permissions and avoiding the use of scp until the vulnerability is patched.