CVE-2018-20685

Name
CVE-2018-20685
Description
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Patch https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2
Patch https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.197&r2=1.198&f=h
Third Party Advisory http://www.securityfocus.com/bid/106531
Patch https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
Third Party Advisory https://usn.ubuntu.com/3885-1/
Third Party Advisory https://www.debian.org/security/2019/dsa-4387
Third Party Advisory https://security.netapp.com/advisory/ntap-20190215-0001/
Third Party Advisory https://security.gentoo.org/glsa/201903-16
Mailing List https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html
Patch https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
MISC https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
REDHAT https://access.redhat.com/errata/RHSA-2019:3702
GENTOO https://security.gentoo.org/glsa/202007-53

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* openssh >= None <= 7.9
cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:* winscp >= None <= 5.13

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
dropbear 3.12-main 2019.78-r1 Natanael Copa <ncopa@alpinelinux.org> fixed
dropbear 3.11-main 2019.78-r1 Natanael Copa <ncopa@alpinelinux.org> fixed
dropbear 3.10-main 2019.78-r1 Natanael Copa <ncopa@alpinelinux.org> fixed