// For flags

CVE-2006-0225

local to local copy uses shell expansion twice

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.

scp en OpenSSH 4.2p1 permite a atacantes ejecutar órdenes de su elección mediante nombres de ficheros que contienen metacaractéres o espacios, que son expandidos dos veces.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2006-01-17 CVE Reserved
  • 2006-01-25 CVE Published
  • 2024-08-07 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
References (66)
URL Tag Source
http://blogs.sun.com/security/entry/sun_alert_102961_security_vulnerability X_refsource_confirm
http://docs.info.apple.com/article.html?artnum=305214 X_refsource_confirm
http://secunia.com/advisories/18579 Third Party Advisory
http://secunia.com/advisories/18650 Third Party Advisory
http://secunia.com/advisories/18736 Third Party Advisory
http://secunia.com/advisories/18798 Third Party Advisory
http://secunia.com/advisories/18850 Third Party Advisory
http://secunia.com/advisories/18910 Third Party Advisory
http://secunia.com/advisories/18964 Third Party Advisory
http://secunia.com/advisories/18969 Third Party Advisory
http://secunia.com/advisories/18970 Third Party Advisory
http://secunia.com/advisories/19159 Third Party Advisory
http://secunia.com/advisories/20723 Third Party Advisory
http://secunia.com/advisories/21129 Third Party Advisory
http://secunia.com/advisories/21262 Third Party Advisory
http://secunia.com/advisories/21492 Third Party Advisory
http://secunia.com/advisories/21724 Third Party Advisory
http://secunia.com/advisories/22196 Third Party Advisory
http://secunia.com/advisories/23241 Third Party Advisory
http://secunia.com/advisories/23340 Third Party Advisory
http://secunia.com/advisories/23680 Third Party Advisory
http://secunia.com/advisories/24479 Third Party Advisory
http://secunia.com/advisories/25607 Third Party Advisory
http://secunia.com/advisories/25936 Third Party Advisory
http://securityreason.com/securityalert/462 Third Party Advisory
http://securitytracker.com/id?1015540 Vdb Entry
http://support.avaya.com/elmodocs2/security/ASA-2006-158.htm X_refsource_confirm
http://support.avaya.com/elmodocs2/security/ASA-2006-174.htm X_refsource_confirm
http://support.avaya.com/elmodocs2/security/ASA-2006-262.htm X_refsource_confirm
http://support.avaya.com/elmodocs2/security/ASA-2007-246.htm X_refsource_confirm
http://www.osvdb.org/22692 Vdb Entry
http://www.securityfocus.com/bid/16369 Vdb Entry
http://www.us-cert.gov/cas/techalerts/TA07-072A.html Third Party Advisory
http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html X_refsource_confirm
http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html X_refsource_confirm
http://www.vupen.com/english/advisories/2006/0306 Vdb Entry
http://www.vupen.com/english/advisories/2006/2490 Vdb Entry
http://www.vupen.com/english/advisories/2006/4869 Vdb Entry
http://www.vupen.com/english/advisories/2007/0930 Vdb Entry
http://www.vupen.com/english/advisories/2007/2120 Vdb Entry
http://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v52.Readme.html#MH00688 X_refsource_confirm
http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=2751 X_refsource_confirm
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=174026 X_refsource_confirm
https://exchange.xforce.ibmcloud.com/vulnerabilities/24305 Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1138 Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9962 Signature
URL Date SRC
URL Date SRC
http://secunia.com/advisories/18595 2018-10-19
URL Date SRC
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/005_ssh.patch 2018-10-19
ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc 2018-10-19
http://itrc.hp.com/service/cki/docDisplay.do?docId=c00815112 2018-10-19
http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html 2018-10-19
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.425802 2018-10-19
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102961-1 2018-10-19
http://www.gentoo.org/security/en/glsa/glsa-200602-11.xml 2018-10-19
http://www.mandriva.com/security/advisories?name=MDKSA-2006:034 2018-10-19
http://www.novell.com/linux/security/advisories/2006_08_openssh.html 2018-10-19
http://www.openpkg.org/security/OpenPKG-SA-2006.003-openssh.html 2018-10-19
http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00062.html 2018-10-19
http://www.redhat.com/support/errata/RHSA-2006-0044.html 2018-10-19
http://www.redhat.com/support/errata/RHSA-2006-0298.html 2018-10-19
http://www.redhat.com/support/errata/RHSA-2006-0698.html 2018-10-19
http://www.securityfocus.com/archive/1/425397/100/0/threaded 2018-10-19
http://www.trustix.org/errata/2006/0004 2018-10-19
http://www.ubuntu.com/usn/usn-255-1 2018-10-19
https://access.redhat.com/security/cve/CVE-2006-0225 2006-09-29
https://bugzilla.redhat.com/show_bug.cgi?id=168167 2006-09-29
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.0
Search vendor "Openbsd" for product "Openssh" and version "3.0"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.0.1
Search vendor "Openbsd" for product "Openssh" and version "3.0.1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.0.1p1
Search vendor "Openbsd" for product "Openssh" and version "3.0.1p1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.0.2
Search vendor "Openbsd" for product "Openssh" and version "3.0.2"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.0.2p1
Search vendor "Openbsd" for product "Openssh" and version "3.0.2p1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.0p1
Search vendor "Openbsd" for product "Openssh" and version "3.0p1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.1
Search vendor "Openbsd" for product "Openssh" and version "3.1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.1p1
Search vendor "Openbsd" for product "Openssh" and version "3.1p1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.2
Search vendor "Openbsd" for product "Openssh" and version "3.2"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.2.2p1
Search vendor "Openbsd" for product "Openssh" and version "3.2.2p1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.2.3p1
Search vendor "Openbsd" for product "Openssh" and version "3.2.3p1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.3
Search vendor "Openbsd" for product "Openssh" and version "3.3"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.3p1
Search vendor "Openbsd" for product "Openssh" and version "3.3p1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.4
Search vendor "Openbsd" for product "Openssh" and version "3.4"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.4p1
Search vendor "Openbsd" for product "Openssh" and version "3.4p1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.5
Search vendor "Openbsd" for product "Openssh" and version "3.5"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.5p1
Search vendor "Openbsd" for product "Openssh" and version "3.5p1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.6
Search vendor "Openbsd" for product "Openssh" and version "3.6"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.6.1
Search vendor "Openbsd" for product "Openssh" and version "3.6.1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.6.1p1
Search vendor "Openbsd" for product "Openssh" and version "3.6.1p1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.6.1p2
Search vendor "Openbsd" for product "Openssh" and version "3.6.1p2"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.7
Search vendor "Openbsd" for product "Openssh" and version "3.7"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.7.1
Search vendor "Openbsd" for product "Openssh" and version "3.7.1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.7.1p2
Search vendor "Openbsd" for product "Openssh" and version "3.7.1p2"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.8
Search vendor "Openbsd" for product "Openssh" and version "3.8"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.8.1
Search vendor "Openbsd" for product "Openssh" and version "3.8.1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.8.1p1
Search vendor "Openbsd" for product "Openssh" and version "3.8.1p1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.9
Search vendor "Openbsd" for product "Openssh" and version "3.9"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.9.1
Search vendor "Openbsd" for product "Openssh" and version "3.9.1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 3.9.1p1
Search vendor "Openbsd" for product "Openssh" and version "3.9.1p1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 4.0p1
Search vendor "Openbsd" for product "Openssh" and version "4.0p1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 4.1p1
Search vendor "Openbsd" for product "Openssh" and version "4.1p1"
-
Affected
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 4.2p1
Search vendor "Openbsd" for product "Openssh" and version "4.2p1"
-
Affected