Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Network
3

CVE-2019-6111

Disclosure Date: January 31, 2019 •
CVE-2019-6111 CVSS v3 Base Score: 5.9
Exploited in the Wild
Reported by gwillcox-r7
View Source Details
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
5.9 Medium
Impact Score:
3.6
Exploitability Score:
2.2
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector (AV):
Network
Attack Complexity (AC):
High
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
None
Integrity (I):
High
Availability (A):
None

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
n/a
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

  • apache,
  • canonical,
  • debian,
  • fedoraproject,
  • freebsd,
  • fujitsu,
  • openbsd,
  • redhat,
  • siemens,
  • winscp

Products

  • debian linux 8.0,
  • debian linux 9.0,
  • enterprise linux 7.0,
  • enterprise linux 8.0,
  • enterprise linux eus 8.1,
  • enterprise linux eus 8.2,
  • enterprise linux eus 8.4,
  • enterprise linux eus 8.6,
  • enterprise linux server aus 8.2,
  • enterprise linux server aus 8.4,
  • enterprise linux server aus 8.6,
  • enterprise linux server tus 8.2,
  • enterprise linux server tus 8.4,
  • enterprise linux server tus 8.6,
  • fedora 30,
  • freebsd,
  • freebsd 12.0,
  • m10-1 firmware,
  • m10-4 firmware,
  • m10-4s firmware,
  • m12-1 firmware,
  • m12-2 firmware,
  • m12-2s firmware,
  • mina sshd 2.2.0,
  • openssh,
  • scalance x204rna eec firmware,
  • scalance x204rna firmware,
  • ubuntu linux 14.04,
  • ubuntu linux 16.04,
  • ubuntu linux 18.04,
  • ubuntu linux 18.10,
  • winscp

Exploited in the Wild

Reported by:

References

Canonical
CVE-2019-6111 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111)
BID-106741 (http://www.securityfocus.com/bid/106741)
Advisory
DSA-4387 (https://www.debian.org/security/2019/dsa-4387)
https://security.netapp.com/advisory/ntap-20190213-0001
USN-3885-1 (https://usn.ubuntu.com/3885-1)
USN-3885-2 (https://usn.ubuntu.com/3885-2)
EXPLOIT-DB-46193 (https://www.exploit-db.com/exploits/46193)
GLSA-201903-16 (https://security.gentoo.org/glsa/201903-16)
[debian-lts-announce] 20190325 [SECURITY] [DLA 1728-1] openssh security update (https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html)
[oss-security] 20190417 Announce: OpenSSH 8.0 released (http://www.openwall.com/lists/oss-security/2019/04/18/1)
FEDORA-2019-0f4190cdb0 (https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G)
[mina-dev] 20190620 [jira] [Created] (SSHD-925) See if SCP vulnerability CVE-2019-6111 applies and mitigate it if so (https://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23@%3Cdev.mina.apache.org%3E)
[mina-dev] 20190623 [jira] [Comment Edited] (SSHD-925) See if SCP vulnerability CVE-2019-6111 applies and mitigate it if so (https://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b@%3Cdev.mina.apache.org%3E)
[mina-dev] 20190623 [jira] [Commented] (SSHD-925) See if SCP vulnerability CVE-2019-6111 applies and mitigate it if so (https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f@%3Cdev.mina.apache.org%3E)
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html
[mina-dev] 20190820 [jira] [Resolved] (SSHD-925) See if SCP vulnerability CVE-2019-6111 applies and mitigate it if so (https://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a@%3Cdev.mina.apache.org%3E)
https://access.redhat.com/errata/RHSA-2019:3702
https://security.netapp.com/advisory/ntap-20190213-0001/
USN-3885-1 (https://usn.ubuntu.com/3885-1/)
USN-3885-2 (https://usn.ubuntu.com/3885-2/)
EXPLOIT-DB-46193 (https://www.exploit-db.com/exploits/46193/)
FEDORA-2019-0f4190cdb0 (https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/)
[oss-security] 20220802 CVE-2022-29154: Rsync client-side arbitrary file write vulnerability. (http://www.openwall.com/lists/oss-security/2022/08/02/1)
Miscellaneous
https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c
https://bugzilla.redhat.com/show_bug.cgi?id=1677794
https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
https://www.freebsd.org/security/advisories/FreeBSD-EN-19:10.scp.asc
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Additional Info

Authenticated
Unknown
Exploitable
Unknown
Reliability
Unknown
Stability
Unknown
Available Mitigations
Unknown
Shelf Life
Unknown
Userbase/Installbase
Unknown
Patch Effectiveness
Unknown
Technical Analysis