ID

VAR-201901-0010


CVE

CVE-2019-6109


TITLE

OpenSSH Access control vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-001217

DESCRIPTION

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c. OpenSSH Contains an access control vulnerability.Information may be obtained and information may be altered. OpenSSH is prone to a security-bypass vulnerability. Successfully exploiting this issue may allow attackers to bypass certain security restrictions and perform unauthorized actions by conducting a man-in-the-middle attack. This may lead to other attacks. OpenSSH 7.9 version is vulnerable; other versions may also be affected. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201903-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: OpenSSH: Multiple vulnerabilities Date: March 20, 2019 Bugs: #675520, #675522 ID: 201903-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in OpenSSH, the worst of which could allow a remote attacker to gain unauthorized access. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All OpenSSH users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/openssh-7.9_p1-r4" References ========== [ 1 ] CVE-2018-20685 https://nvd.nist.gov/vuln/detail/CVE-2018-20685 [ 2 ] CVE-2019-6109 https://nvd.nist.gov/vuln/detail/CVE-2019-6109 [ 3 ] CVE-2019-6110 https://nvd.nist.gov/vuln/detail/CVE-2019-6110 [ 4 ] CVE-2019-6111 https://nvd.nist.gov/vuln/detail/CVE-2019-6111 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201903-16 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2019 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: openssh security, bug fix, and enhancement update Advisory ID: RHSA-2019:3702-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:3702 Issue date: 2019-11-05 CVE Names: CVE-2018-20685 CVE-2019-6109 CVE-2019-6111 ===================================================================== 1. Summary: An update for openssh is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. The following packages have been upgraded to a later upstream version: openssh (8.0p1). Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically. 1686065 - SSH connections get closed when time-based rekeyring is used and ClientAliveMaxCount=0 1691045 - Rebase OpenSSH to latest release (8.0p1?) 1707485 - Use high-level API to do signatures 1712436 - MD5 is used when writing password protected PEM 1732424 - ssh-keygen -A fails in FIPS mode because of DSA key 1732449 - rsa-sha2-*-cert-v01@openssh.com host key types are ignored in FIPS despite being in the policy 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): aarch64: openssh-askpass-8.0p1-3.el8.aarch64.rpm openssh-askpass-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-cavs-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-clients-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-debugsource-8.0p1-3.el8.aarch64.rpm openssh-keycat-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-ldap-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-server-debuginfo-8.0p1-3.el8.aarch64.rpm pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.aarch64.rpm ppc64le: openssh-askpass-8.0p1-3.el8.ppc64le.rpm openssh-askpass-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-cavs-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-clients-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-debugsource-8.0p1-3.el8.ppc64le.rpm openssh-keycat-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-ldap-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-server-debuginfo-8.0p1-3.el8.ppc64le.rpm pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.ppc64le.rpm s390x: openssh-askpass-8.0p1-3.el8.s390x.rpm openssh-askpass-debuginfo-8.0p1-3.el8.s390x.rpm openssh-cavs-debuginfo-8.0p1-3.el8.s390x.rpm openssh-clients-debuginfo-8.0p1-3.el8.s390x.rpm openssh-debuginfo-8.0p1-3.el8.s390x.rpm openssh-debugsource-8.0p1-3.el8.s390x.rpm openssh-keycat-debuginfo-8.0p1-3.el8.s390x.rpm openssh-ldap-debuginfo-8.0p1-3.el8.s390x.rpm openssh-server-debuginfo-8.0p1-3.el8.s390x.rpm pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.s390x.rpm x86_64: openssh-askpass-8.0p1-3.el8.x86_64.rpm openssh-askpass-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-cavs-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-clients-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-debugsource-8.0p1-3.el8.x86_64.rpm openssh-keycat-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-ldap-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-server-debuginfo-8.0p1-3.el8.x86_64.rpm pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.x86_64.rpm Red Hat Enterprise Linux BaseOS (v. 8): Source: openssh-8.0p1-3.el8.src.rpm aarch64: openssh-8.0p1-3.el8.aarch64.rpm openssh-askpass-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-cavs-8.0p1-3.el8.aarch64.rpm openssh-cavs-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-clients-8.0p1-3.el8.aarch64.rpm openssh-clients-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-debugsource-8.0p1-3.el8.aarch64.rpm openssh-keycat-8.0p1-3.el8.aarch64.rpm openssh-keycat-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-ldap-8.0p1-3.el8.aarch64.rpm openssh-ldap-debuginfo-8.0p1-3.el8.aarch64.rpm openssh-server-8.0p1-3.el8.aarch64.rpm openssh-server-debuginfo-8.0p1-3.el8.aarch64.rpm pam_ssh_agent_auth-0.10.3-7.3.el8.aarch64.rpm pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.aarch64.rpm ppc64le: openssh-8.0p1-3.el8.ppc64le.rpm openssh-askpass-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-cavs-8.0p1-3.el8.ppc64le.rpm openssh-cavs-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-clients-8.0p1-3.el8.ppc64le.rpm openssh-clients-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-debugsource-8.0p1-3.el8.ppc64le.rpm openssh-keycat-8.0p1-3.el8.ppc64le.rpm openssh-keycat-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-ldap-8.0p1-3.el8.ppc64le.rpm openssh-ldap-debuginfo-8.0p1-3.el8.ppc64le.rpm openssh-server-8.0p1-3.el8.ppc64le.rpm openssh-server-debuginfo-8.0p1-3.el8.ppc64le.rpm pam_ssh_agent_auth-0.10.3-7.3.el8.ppc64le.rpm pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.ppc64le.rpm s390x: openssh-8.0p1-3.el8.s390x.rpm openssh-askpass-debuginfo-8.0p1-3.el8.s390x.rpm openssh-cavs-8.0p1-3.el8.s390x.rpm openssh-cavs-debuginfo-8.0p1-3.el8.s390x.rpm openssh-clients-8.0p1-3.el8.s390x.rpm openssh-clients-debuginfo-8.0p1-3.el8.s390x.rpm openssh-debuginfo-8.0p1-3.el8.s390x.rpm openssh-debugsource-8.0p1-3.el8.s390x.rpm openssh-keycat-8.0p1-3.el8.s390x.rpm openssh-keycat-debuginfo-8.0p1-3.el8.s390x.rpm openssh-ldap-8.0p1-3.el8.s390x.rpm openssh-ldap-debuginfo-8.0p1-3.el8.s390x.rpm openssh-server-8.0p1-3.el8.s390x.rpm openssh-server-debuginfo-8.0p1-3.el8.s390x.rpm pam_ssh_agent_auth-0.10.3-7.3.el8.s390x.rpm pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.s390x.rpm x86_64: openssh-8.0p1-3.el8.x86_64.rpm openssh-askpass-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-cavs-8.0p1-3.el8.x86_64.rpm openssh-cavs-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-clients-8.0p1-3.el8.x86_64.rpm openssh-clients-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-debugsource-8.0p1-3.el8.x86_64.rpm openssh-keycat-8.0p1-3.el8.x86_64.rpm openssh-keycat-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-ldap-8.0p1-3.el8.x86_64.rpm openssh-ldap-debuginfo-8.0p1-3.el8.x86_64.rpm openssh-server-8.0p1-3.el8.x86_64.rpm openssh-server-debuginfo-8.0p1-3.el8.x86_64.rpm pam_ssh_agent_auth-0.10.3-7.3.el8.x86_64.rpm pam_ssh_agent_auth-debuginfo-0.10.3-7.3.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-20685 https://access.redhat.com/security/cve/CVE-2019-6109 https://access.redhat.com/security/cve/CVE-2019-6111 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXcHzKNzjgjWX9erEAQiytQ/6Apphov2V0QmnXA+KO3ZZKBPXtgKv8Sv1 dPtXhTC+Keq4yX9/bXlIuyk6BUsMeaiIMlL5bSSKtq2I7rVxwubTcPX4rD+pQvx8 ArNJgn7U2/3xqwc0R8dNXx6o8vB1M6jXDtu8fKJOxW48evDJf6gE4gX2KUM9yxR2 MhCoHVkLp9a5f0T11yFPI11H0P8gXXQgboAkdt82Ui35T4tD8RndVyPCsllN2c/X QCCbvZ9e8OLJJoxsOryLcw8tpQHXK2AJMXWv0Us99kQtbaBULWWahhrg/tftLxtT pILFBaB/RsmGg1O6OkxJ2CuKl6ATC2Wlj/Z7uYPrS7MQDn+fXkH2gfcjb4Z4rqIL IyKbUpsyFEAaV5rJUeRaS7dGfuQldQbS96P8lUpCcOXPbYD8FgTrW2q3NjOKgYMU +gh2xPwmlRm+iYfmedPoR2+bTWNYv8JS+Cp/fZF4IFx2EJPQcxKLYshNKgcfkNkR rIZ4brUI79p84H01TcTh4mFAbR63Y+c36UAI3/fM/W/RkZn/PdoJtpfwg/tjOYZH rt9kL7SfAEhjHNtBuJGNol6e124srS6300hnfFovAr6llDOcYlrh3ZgVZjVrn6E8 TZhyZ84TGMOqykfH7B9XkJH82X+x3rd2m0ovCPq+Ly62BasdXVd0C2snzbx8OAM8 I+am8dhVlyM= =iPw4 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . scp client multiple vulnerabilities =================================== The latest version of this advisory is available at: https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt Overview -------- SCP clients from multiple vendors are susceptible to a malicious scp server performing unauthorized changes to target directory and/or client output manipulation. Description ----------- Many scp clients fail to verify if the objects returned by the scp server match those it asked for. This issue dates back to 1983 and rcp, on which scp is based. A separate flaw in the client allows the target directory attributes to be changed arbitrarily. Finally, two vulnerabilities in clients may allow server to spoof the client output. Impact ------ Malicious scp server can write arbitrary files to scp target directory, change the target directory permissions and to spoof the client output. Details ------- The discovered vulnerabilities, described in more detail below, enables the attack described here in brief. 1. The attacker controlled server or Man-in-the-Middle(*) attack drops .bash_aliases file to victim's home directory when the victim performs scp operation from the server. The transfer of extra files is hidden by sending ANSI control sequences via stderr. For example: user@local:~$ scp user@remote:readme.txt . readme.txt 100% 494 1.6KB/s 00:00 user@local:~$ 2. Once the victim launches a new shell, the malicious commands in .bash_aliases get executed. *) Man-in-the-Middle attack does require the victim to accept the wrong host fingerprint. Vulnerabilities --------------- 1. CWE-20: scp client improper directory name validation [CVE-2018-20685] The scp client allows server to modify permissions of the target directory by using empty ("D0777 0 \n") or dot ("D0777 0 .\n") directory name. 2. CWE-20: scp client missing received object name validation [CVE-2019-6111] Due to the scp implementation being derived from 1983 rcp [1], the server chooses which files/directories are sent to the client. However, scp client only perform cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example overwrite .ssh/authorized_keys). The same vulnerability in WinSCP is known as CVE-2018-20684. 3. 4. Proof-of-Concept ---------------- Proof of concept malicious scp server will be released at a later date. Vulnerable versions ------------------- The following software packages have some or all vulnerabilities: ver #1 #2 #3 #4 OpenSSH scp <=7.9 x x x x PuTTY PSCP ? - - x x WinSCP scp mode <=5.13 - x - - Tectia SSH scpg3 is not affected since it exclusively uses sftp protocol. Mitigation ---------- 1. OpenSSH 1.1 Switch to sftp if possible 1.2 Alternatively apply the following patch to harden scp against most server-side manipulation attempts: https://sintonen.fi/advisories/scp-name-validator.patch NOTE: This patch may cause problems if the the remote and local shells don't agree on the way glob() pattern matching works. YMMV. 2. PuTTY 2.1 No fix is available yet 3. WinSCP 3.1. Upgrade to WinSCP 5.14 or later Similar or prior work --------------------- 1. CVE-2000-0992 - scp overwrites arbitrary files References ---------- 1. https://www.jeffgeerling.com/blog/brief-history-ssh-and-remote-access Credits ------- The vulnerability was discovered by Harry Sintonen / F-Secure Corporation. Timeline -------- 2018.08.08 initial discovery of vulnerabilities #1 and #2 2018.08.09 reported vulnerabilities #1 and #2 to OpenSSH 2018.08.10 OpenSSH acknowledged the vulnerabilities 2018.08.14 discovered & reported vulnerability #3 to OpenSSH 2018.08.15 discovered & reported vulnerability #4 to OpenSSH 2018.08.30 reported PSCP vulnerabilities (#3 and #4) to PuTTY developers 2018.08.31 reported WinSCP vulnerability (#2) to WinSCP developers 2018.09.04 WinSCP developers reported the vulnerability #2 fixed 2018.11.12 requested a status update from OpenSSH 2018.11.16 OpenSSH fixed vulnerability #1 2019.01.07 requested a status update from OpenSSH 2019.01.08 requested CVE assignments from MITRE 2019.01.10 received CVE assignments from MITRE 2019.01.11 public disclosure of the advisory 2019.01.14 added a warning about the potential issues caused by the patch . All the vulnerabilities are in found in the scp client implementing the SCP protocol. The check added in this version can lead to regression if the client and the server have differences in wildcard expansion rules. If the server is trusted for that purpose, the check can be disabled with a new -T option to the scp client. For the stable distribution (stretch), these problems have been fixed in version 1:7.4p1-10+deb9u5. For the detailed security status of openssh please refer to its security tracker page at: https://security-tracker.debian.org/tracker/openssh Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEE8vi34Qgfo83x35gF3rYcyPpXRFsFAlxe0w0ACgkQ3rYcyPpX RFs85AgA0GrSHO4Qf5FVsE3oXa+nMkZ4U6pbOA9dHotX54DEyNuIJrOsOv01cFxQ t2Z6uDkZptmHZT4uSWg2xIgMvpkGo9906ziZfHc0LTuHl8j++7cCDIDGZBm/iZaX ueQfl85gHDpte41JvUtpSBAwk1Bic7ltLUPDIGEiq6nQboxHIzsU7ULVb1l0wNxF sEFDPWGBS01HTa+QWgQaG/wbEhMRDcVz1Ck7dqpT2soQRohDWxU01j14q1EKe9O9 GHiWECvFSHBkkI/v8lNfSWnOWYa/+Aknri0CpjPc/bqh2Yx9rgp/Q5+FJ/FxJjmC bHFd+tbxB1LxEO96zKguYpPIzw7Kcw== =5Fd8 -----END PGP SIGNATURE-----

Trust: 2.34

sources: NVD: CVE-2019-6109 // JVNDB: JVNDB-2019-001217 // BID: 106843 // VULMON: CVE-2019-6109 // PACKETSTORM: 152154 // PACKETSTORM: 155158 // PACKETSTORM: 151175 // PACKETSTORM: 151601

AFFECTED PRODUCTS

vendor:debianmodel:linuxscope:eqversion:8.0

Trust: 1.0

vendor:fujitsumodel:m10-1scope:ltversion:xcp2361

Trust: 1.0

vendor:redhatmodel:enterprise linuxscope:eqversion:8.0

Trust: 1.0

vendor:fujitsumodel:m10-4sscope:ltversion:xcp3070

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:16.04

Trust: 1.0

vendor:redhatmodel:enterprise linux server tusscope:eqversion:8.4

Trust: 1.0

vendor:redhatmodel:enterprise linux server tusscope:eqversion:8.6

Trust: 1.0

vendor:siemensmodel:scalance x204rna eecscope:ltversion:3.2.7

Trust: 1.0

vendor:winscpmodel:winscpscope:lteversion:5.13

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:18.10

Trust: 1.0

vendor:redhatmodel:enterprise linux server ausscope:eqversion:8.2

Trust: 1.0

vendor:siemensmodel:scalance x204rnascope:ltversion:3.2.7

Trust: 1.0

vendor:fujitsumodel:m10-4sscope:ltversion:xcp2361

Trust: 1.0

vendor:redhatmodel:enterprise linux eusscope:eqversion:8.6

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:30

Trust: 1.0

vendor:netappmodel:storage automation storescope:eqversion: -

Trust: 1.0

vendor:openbsdmodel:opensshscope:lteversion:7.9

Trust: 1.0

vendor:netappmodel:ontap select deployscope:eqversion: -

Trust: 1.0

vendor:fujitsumodel:m12-1scope:ltversion:xcp3070

Trust: 1.0

vendor:redhatmodel:enterprise linux eusscope:eqversion:8.4

Trust: 1.0

vendor:redhatmodel:enterprise linux server tusscope:eqversion:8.2

Trust: 1.0

vendor:redhatmodel:enterprise linux server ausscope:eqversion:8.4

Trust: 1.0

vendor:fujitsumodel:m10-4scope:ltversion:xcp3070

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:18.04

Trust: 1.0

vendor:fujitsumodel:m12-2scope:ltversion:xcp3070

Trust: 1.0

vendor:fujitsumodel:m12-2sscope:ltversion:xcp3070

Trust: 1.0

vendor:fujitsumodel:m12-1scope:ltversion:xcp2361

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:14.04

Trust: 1.0

vendor:fujitsumodel:m10-4scope:ltversion:xcp2361

Trust: 1.0

vendor:redhatmodel:enterprise linux eusscope:eqversion:8.2

Trust: 1.0

vendor:redhatmodel:enterprise linux eusscope:eqversion:8.1

Trust: 1.0

vendor:fujitsumodel:m12-2scope:ltversion:xcp2361

Trust: 1.0

vendor:fujitsumodel:m12-2sscope:ltversion:xcp2361

Trust: 1.0

vendor:netappmodel:element softwarescope:eqversion: -

Trust: 1.0

vendor:redhatmodel:enterprise linux server ausscope:eqversion:8.6

Trust: 1.0

vendor:fujitsumodel:m10-1scope:ltversion:xcp3070

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:9.0

Trust: 1.0

vendor:openbsdmodel:opensshscope:eqversion:7.9

Trust: 0.8

vendor:winscpmodel:winscpscope: - version: -

Trust: 0.8

vendor:susemodel:linux enterprise server 12-sp2scope: - version: -

Trust: 0.3

vendor:susemodel:linux enterprise server 12-sp1scope: - version: -

Trust: 0.3

vendor:susemodel:linux enterprise server sp3scope:eqversion:12

Trust: 0.3

vendor:susemodel:linux enterprise server gascope:eqversion:12

Trust: 0.3

vendor:susemodel:linux enterprise server sp4scope:eqversion:11

Trust: 0.3

vendor:susemodel:linux enterprise server sp3 ltssscope:eqversion:11

Trust: 0.3

vendor:redhatmodel:enterprise linuxscope:eqversion:7

Trust: 0.3

vendor:redhatmodel:enterprise linuxscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linuxscope:eqversion:5

Trust: 0.3

vendor:opensshmodel:opensshscope:eqversion:7.9

Trust: 0.3

vendor:f5model:traffix sdcscope:eqversion:5.1

Trust: 0.3

vendor:f5model:traffix sdcscope:eqversion:5.0

Trust: 0.3

vendor:f5model:traffix sdcscope:eqversion:4.4

Trust: 0.3

sources: BID: 106843 // JVNDB: JVNDB-2019-001217 // NVD: CVE-2019-6109

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-6109
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-6109
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201901-467
value: MEDIUM

Trust: 0.6

VULMON: CVE-2019-6109
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-6109
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:H/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 4.9
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

nvd@nist.gov: CVE-2019-6109
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 1.6
impactScore: 5.2
version: 3.1

Trust: 1.0

NVD: CVE-2019-6109
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULMON: CVE-2019-6109 // JVNDB: JVNDB-2019-001217 // CNNVD: CNNVD-201901-467 // NVD: CVE-2019-6109

PROBLEMTYPE DATA

problemtype:CWE-116

Trust: 1.0

problemtype:CWE-284

Trust: 0.8

sources: JVNDB: JVNDB-2019-001217 // NVD: CVE-2019-6109

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 152154 // CNNVD: CNNVD-201901-467

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-201901-467

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-001217

PATCH

title:CVS log for src/usr.bin/ssh/progressmeter.curl:https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c

Trust: 0.8

title:CVS log for src/usr.bin/ssh/scp.curl:https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c

Trust: 0.8

title:OpenSSH Security vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=88613

Trust: 0.6

title:The Registerurl:https://www.theregister.co.uk/2019/01/15/scp_vulnerability/

Trust: 0.2

title:Red Hat: Moderate: openssh security, bug fix, and enhancement updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20193702 - Security Advisory

Trust: 0.1

title:Ubuntu Security Notice: openssh vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-3885-1

Trust: 0.1

title:Debian CVElist Bug Report Logs: openssh-client: scp can send arbitrary control characters / escape sequences to the terminal (CVE-2019-6109)url:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=dffe92fd93b8f745f5f15bc2f29dc935

Trust: 0.1

title:Debian CVElist Bug Report Logs: CVE-2019-6111 not fixed, file transfer of unwanted files by malicious SSH server still possibleurl:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=74b791ca4fdf54c27d2b50ef6845ef8e

Trust: 0.1

title:Arch Linux Issues: url:https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues&qid=CVE-2019-6109

Trust: 0.1

title:Debian CVElist Bug Report Logs: openssh: CVE-2018-20685: scp.c in the scp client allows remote SSH servers to bypass intended access restrictionsurl:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=8394bb17731a99ef76b185cbc70acfa3

Trust: 0.1

title:Amazon Linux AMI: ALAS-2019-1313url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2019-1313

Trust: 0.1

title:Amazon Linux 2: ALAS2-2019-1216url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux2&qid=ALAS2-2019-1216

Trust: 0.1

title:IBM: IBM Security Bulletin: Vulnerabilities in OpenSSH affect AIX (CVE-2018-20685 CVE-2018-6109 CVE-2018-6110 CVE-2018-6111) Security Bulletinurl:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=50a54c2fb43b489f64442dcf4f25bc3b

Trust: 0.1

title:IBM: Security Bulletin: Multiple vulnerabilities affect IBM Cloud Object Storage Systems (February 2020v1)url:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=979e60202a29c3c55731e37f8ddc5a3b

Trust: 0.1

title:IBM: IBM Security Bulletin: Vyatta 5600 vRouter Software Patches – Releases 1801-w and 1801-yurl:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=bf3f2299a8658b7cd3984c40e7060666

Trust: 0.1

title:Siemens Security Advisories: Siemens Security Advisoryurl:https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories&qid=ec6577109e640dac19a6ddb978afe82d

Trust: 0.1

title: - url:https://github.com/Live-Hack-CVE/CVE-2019-6109

Trust: 0.1

title: - url:https://github.com/h4xrOx/Direct-Admin-Vulnerability-Disclosure

Trust: 0.1

title: - url:https://github.com/numaan911098/leadgenapp-bug-report

Trust: 0.1

title:DC-4-Vulnhub-Walkthroughurl:https://github.com/vshaliii/DC-4-Vulnhub-Walkthrough

Trust: 0.1

title:nmapurl:https://github.com/devairdarolt/nmap

Trust: 0.1

title:TrivyWeburl:https://github.com/KorayAgaya/TrivyWeb

Trust: 0.1

title:github_aquasecurity_trivyurl:https://github.com/back8/github_aquasecurity_trivy

Trust: 0.1

title:Funbox2-rookieurl:https://github.com/vaishali1998/Funbox2-rookie

Trust: 0.1

title:trivyurl:https://github.com/simiyo/trivy

Trust: 0.1

title:securityurl:https://github.com/umahari/security

Trust: 0.1

title: - url:https://github.com/Mohzeela/external-secret

Trust: 0.1

title:Vulnerability-Scanner-for-Containersurl:https://github.com/t31m0/Vulnerability-Scanner-for-Containers

Trust: 0.1

title:trivyurl:https://github.com/aquasecurity/trivy

Trust: 0.1

title:trivyurl:https://github.com/knqyf263/trivy

Trust: 0.1

title:trivyurl:https://github.com/siddharthraopotukuchi/trivy

Trust: 0.1

title:Basic-Pentesting-2-Vulnhub-Walkthroughurl:https://github.com/vshaliii/Basic-Pentesting-2-Vulnhub-Walkthrough

Trust: 0.1

title: - url:https://github.com/bioly230/THM_Skynet

Trust: 0.1

title:Basic-Pentesting-2url:https://github.com/vshaliii/Basic-Pentesting-2

Trust: 0.1

sources: VULMON: CVE-2019-6109 // JVNDB: JVNDB-2019-001217 // CNNVD: CNNVD-201901-467

EXTERNAL IDS

db:NVDid:CVE-2019-6109

Trust: 3.2

db:SIEMENSid:SSA-412672

Trust: 1.7

db:JVNDBid:JVNDB-2019-001217

Trust: 0.8

db:PACKETSTORMid:152154

Trust: 0.7

db:AUSCERTid:ESB-2019.1255

Trust: 0.6

db:AUSCERTid:ESB-2020.1280.2

Trust: 0.6

db:AUSCERTid:ESB-2020.1280

Trust: 0.6

db:AUSCERTid:ESB-2019.1270

Trust: 0.6

db:AUSCERTid:ESB-2019.0410.3

Trust: 0.6

db:AUSCERTid:ESB-2019.0605

Trust: 0.6

db:AUSCERTid:ESB-2021.3698

Trust: 0.6

db:AUSCERTid:ESB-2019.1420

Trust: 0.6

db:CNNVDid:CNNVD-201901-467

Trust: 0.6

db:BIDid:106843

Trust: 0.3

db:ICS CERTid:ICSA-22-349-21

Trust: 0.1

db:VULMONid:CVE-2019-6109

Trust: 0.1

db:PACKETSTORMid:155158

Trust: 0.1

db:PACKETSTORMid:151175

Trust: 0.1

db:PACKETSTORMid:151601

Trust: 0.1

sources: VULMON: CVE-2019-6109 // BID: 106843 // JVNDB: JVNDB-2019-001217 // PACKETSTORM: 152154 // PACKETSTORM: 155158 // PACKETSTORM: 151175 // PACKETSTORM: 151601 // CNNVD: CNNVD-201901-467 // NVD: CVE-2019-6109

REFERENCES

url:https://access.redhat.com/errata/rhsa-2019:3702

Trust: 2.4

url:https://www.debian.org/security/2019/dsa-4387

Trust: 2.3

url:https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt

Trust: 2.1

url:https://usn.ubuntu.com/3885-1/

Trust: 1.8

url:https://security.gentoo.org/glsa/201903-16

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2019-6109

Trust: 1.8

url:https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c

Trust: 1.7

url:https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c

Trust: 1.7

url:https://security.netapp.com/advisory/ntap-20190213-0001/

Trust: 1.7

url:https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html

Trust: 1.7

url:http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html

Trust: 1.7

url:https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Trust: 1.7

url:https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Trust: 1.7

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/w3yvq2bptovdcfdvnc2ggf5p5isfg37g/

Trust: 1.1

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6109

Trust: 0.8

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/w3yvq2bptovdcfdvnc2ggf5p5isfg37g/

Trust: 0.6

url:https://www.suse.com/support/update/announcement/2019/suse-su-201914030-1.html

Trust: 0.6

url:https://www.suse.com/support/update/announcement/2019/suse-su-20190941-1.html

Trust: 0.6

url:https://www.suse.com/support/update/announcement/2019/suse-su-20190496-1.html

Trust: 0.6

url:https://www.suse.com/support/update/announcement/2019/suse-su-201914016-1.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/76170

Trust: 0.6

url:https://packetstormsecurity.com/files/152154/gentoo-linux-security-advisory-201903-16.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/75338

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.1280.2/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.3698

Trust: 0.6

url:https://www.auscert.org.au/bulletins/78994

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.1280/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/78934

Trust: 0.6

url:https://www.auscert.org.au/bulletins/79690

Trust: 0.6

url:https://www-01.ibm.com/support/docview.wss?uid=ibm10882554

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2019-6109

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2019-6111

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2018-20685

Trust: 0.4

url:http://www.openssh.org/

Trust: 0.3

url:https://support.f5.com/csp/article/k12252011

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2019-6110

Trust: 0.2

url:https://cwe.mitre.org/data/definitions/116.html

Trust: 0.1

url:https://tools.cisco.com/security/center/viewalert.x?alertid=59542

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-21

Trust: 0.1

url:https://creativecommons.org/licenses/by-sa/2.5

Trust: 0.1

url:https://security.gentoo.org/

Trust: 0.1

url:https://bugs.gentoo.org.

Trust: 0.1

url:https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2019-6111

Trust: 0.1

url:https://access.redhat.com/security/updates/classification/#moderate

Trust: 0.1

url:https://bugzilla.redhat.com/):

Trust: 0.1

url:https://access.redhat.com/security/team/key/

Trust: 0.1

url:https://access.redhat.com/articles/11258

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2018-20685

Trust: 0.1

url:https://access.redhat.com/security/team/contact/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-20684

Trust: 0.1

url:https://sintonen.fi/advisories/scp-name-validator.patch

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2000-0992

Trust: 0.1

url:https://www.jeffgeerling.com/blog/brief-history-ssh-and-remote-access

Trust: 0.1

url:https://www.debian.org/security/faq

Trust: 0.1

url:https://security-tracker.debian.org/tracker/openssh

Trust: 0.1

url:https://www.debian.org/security/

Trust: 0.1

sources: VULMON: CVE-2019-6109 // BID: 106843 // JVNDB: JVNDB-2019-001217 // PACKETSTORM: 152154 // PACKETSTORM: 155158 // PACKETSTORM: 151175 // PACKETSTORM: 151601 // CNNVD: CNNVD-201901-467 // NVD: CVE-2019-6109

CREDITS

Gentoo

Trust: 0.7

sources: PACKETSTORM: 152154 // CNNVD: CNNVD-201901-467

SOURCES

db:VULMONid:CVE-2019-6109
db:BIDid:106843
db:JVNDBid:JVNDB-2019-001217
db:PACKETSTORMid:152154
db:PACKETSTORMid:155158
db:PACKETSTORMid:151175
db:PACKETSTORMid:151601
db:CNNVDid:CNNVD-201901-467
db:NVDid:CVE-2019-6109

LAST UPDATE DATE

2024-08-14T12:46:31.509000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2019-6109date:2023-11-07T00:00:00
db:BIDid:106843date:2019-01-11T00:00:00
db:JVNDBid:JVNDB-2019-001217date:2019-02-14T00:00:00
db:CNNVDid:CNNVD-201901-467date:2022-12-14T00:00:00
db:NVDid:CVE-2019-6109date:2023-11-07T03:13:05.160

SOURCES RELEASE DATE

db:VULMONid:CVE-2019-6109date:2019-01-31T00:00:00
db:BIDid:106843date:2019-01-11T00:00:00
db:JVNDBid:JVNDB-2019-001217date:2019-02-14T00:00:00
db:PACKETSTORMid:152154date:2019-03-20T16:09:02
db:PACKETSTORMid:155158date:2019-11-06T15:55:27
db:PACKETSTORMid:151175date:2019-01-16T15:04:39
db:PACKETSTORMid:151601date:2019-02-11T16:13:15
db:CNNVDid:CNNVD-201901-467date:2019-01-15T00:00:00
db:NVDid:CVE-2019-6109date:2019-01-31T18:29:00.710