CVE-2018-20685

Name
CVE-2018-20685
Description
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Patch https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2
Patch https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.197&r2=1.198&f=h
Third Party Advisory http://www.securityfocus.com/bid/106531
Patch https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
Third Party Advisory https://usn.ubuntu.com/3885-1/
Third Party Advisory https://www.debian.org/security/2019/dsa-4387
Third Party Advisory https://security.netapp.com/advisory/ntap-20190215-0001/
Third Party Advisory https://security.gentoo.org/glsa/201903-16
Mailing List https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html
Patch https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
MISC https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
REDHAT https://access.redhat.com/errata/RHSA-2019:3702
GENTOO https://security.gentoo.org/glsa/202007-53
Patch https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* openssh >= None <= 7.9
cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:* winscp >= None <= 5.13

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
openssh edge-main 7.9_p1-r3 None fixed
openssh edge-main 7.7_p1-r4 None possibly vulnerable
openssh edge-main 7.5_p1-r8 None possibly vulnerable
openssh edge-main 7.4_p1-r0 None possibly vulnerable
openssh 3.22-main 7.9_p1-r3 None fixed
openssh 3.22-main 7.7_p1-r4 None possibly vulnerable
openssh 3.22-main 7.5_p1-r8 None possibly vulnerable
openssh 3.22-main 7.4_p1-r0 None possibly vulnerable
openssh 3.21-main 7.9_p1-r3 None fixed
openssh 3.21-main 7.7_p1-r4 None possibly vulnerable
openssh 3.21-main 7.5_p1-r8 None possibly vulnerable
openssh 3.21-main 7.4_p1-r0 None possibly vulnerable
openssh 3.20-main 7.9_p1-r3 None fixed
openssh 3.20-main 7.7_p1-r4 None possibly vulnerable
openssh 3.20-main 7.5_p1-r8 None possibly vulnerable
openssh 3.20-main 7.4_p1-r0 None possibly vulnerable
openssh 3.19-main 7.9_p1-r3 None fixed
openssh 3.19-main 7.7_p1-r4 None possibly vulnerable
openssh 3.19-main 7.5_p1-r8 None possibly vulnerable
openssh 3.19-main 7.4_p1-r0 None possibly vulnerable
openssh 3.18-main 7.9_p1-r3 None fixed
openssh 3.17-main 7.9_p1-r3 None fixed
openssh 3.12-main 7.9_p1-r3 None fixed
openssh 3.11-main 7.9_p1-r3 None fixed
openssh 3.10-main 7.9_p1-r3 None fixed
dropbear edge-main 2020.79-r0 None fixed
dropbear 3.22-main 2020.79-r0 None fixed
dropbear 3.21-main 2020.79-r0 None fixed
dropbear 3.20-main 2020.79-r0 None fixed
dropbear 3.19-main 2020.79-r0 None fixed
dropbear 3.18-main 2020.79-r0 None fixed
dropbear 3.17-main 2020.79-r0 None fixed
dropbear 3.12-main 2019.78-r1 Natanael Copa <ncopa@alpinelinux.org> fixed
dropbear 3.11-main 2019.78-r1 Natanael Copa <ncopa@alpinelinux.org> fixed
dropbear 3.10-main 2019.78-r1 Natanael Copa <ncopa@alpinelinux.org> fixed