CVSS: 5.9EPSS: 0%CPEs: 55EXPL: 3CVE-2019-6111 – OpenSSH SCP Client - Write Arbitrary Files
https://notcve.org/view.php?id=CVE-2019-6111
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). • https://www.exploit-db.com/exploits/46516 https://www.exploit-db.com/exploits/46193 http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html http://www.openwall.com/lists/oss-security/2019/04/18/1 http://www.openwall.com/lists/oss-security/2022/08/02/1 http://www.securityfocus.com/bid/106741 https://access.redhat.com/errata/RHSA-2019:3702 https://bugzilla.redhat.com/show_bug.cgi?id=1677794 https://cert-portal.siemens.com/productcert/pdf/ssa-412672&# • CWE-20: Improper Input Validation CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20684
https://notcve.org/view.php?id=CVE-2018-20684
In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files. This affects TSCPFileSystem::SCPSink in core/ScpFileSystem.cpp. En WinSCP, en versiones anteriores a la 5.14 beta, debido a la falta de validación, la implementación de scp aceptaría archivos arbitrarios enviados por el servidor, lo que podría sobrescribir archivos no relacionados. Esto afecta a TSCPFileSystem::SCPSink en core/ScpFileSystem.cpp. • http://www.securityfocus.com/bid/106526 https://github.com/winscp/winscp/commit/49d876f2c5fc00bcedaa986a7cf6dedd6bf16f54 https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt https://winscp.net/eng/docs/history https://winscp.net/tracker/1675 https://www.oracle.com/security-alerts/cpujan2020.html • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 56EXPL: 0CVE-2018-20685 – openssh: scp client improper directory name validation
https://notcve.org/view.php?id=CVE-2018-20685
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side. En OpenSSH 7.9, scp.c en el cliente scp permite que los servidores SSH omitan las restricciones de acceso planeadas mediante un nombre de archivo "." o un nombre de archivo vacío. El impacto consiste en modificar los permisos del directorio objetivo en el lado del cliente. • http://www.securityfocus.com/bid/106531 https://access.redhat.com/errata/RHSA-2019:3702 https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.197&r2=1.198&f=h https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2 https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html https://security.gentoo.org/glsa/201903-16 https://security.gentoo.org/glsa/202007- • CWE-20: Improper Input Validation CWE-863: Incorrect Authorization •
CVSS: 5.8EPSS: 0%CPEs: 3EXPL: 0CVE-2014-2735
https://notcve.org/view.php?id=CVE-2014-2735
WinSCP before 5.5.3, when FTP with TLS is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. WinSCP anterior a 5.5.3, cuando FTP con TLS está utilizado, no verifica que el nombre del servidor coincide un nombre de dominio en el nombre común del sujeto (CN) o el campo subjectAltName del certificado X.509, lo que permite a atacantes man-in-the-middle falsificar servidores SSL a través de un certificado valido arbitrario. • http://winscp.net/eng/docs/history http://winscp.net/tracker/show_bug.cgi?id=1152 http://www.securityfocus.com/archive/1/531847/100/0/threaded • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 2%CPEs: 57EXPL: 0CVE-2013-4852
https://notcve.org/view.php?id=CVE-2013-4852
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow. Desbordamiento de entero en PuTTY 0.62 y anteriores, WinSCP anterior a 5.1.6, y otros productos que usan PuTTY, permite a servidores SSH remotos provocar una denegación de servicio (caída) y posiblemente ejecutar código arbitrario en determinadas aplicaciones que utilizan PuTTY a través de un tamaño negativo en el valor de la firma en la clave RSA durante el handshake SSH, que provoca un desbordamiento basado en memoria dinámica. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718779 http://lists.opensuse.org/opensuse-updates/2013-08/msg00035.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00041.html http://secunia.com/advisories/54379 http://secunia.com/advisories/54517 http://secunia.com/advisories/54533 http://svn.tartarus.org/sgt?view=revision&sortby=date&revision=9896 http://winscp.net/tracker/show_bug.cgi?id=1017 http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-signature&# • CWE-189: Numeric Errors •