OpenSSH CVE-2017-15906: Insecure Write Operations in Readonly Mode
Summary
CVE-2017-15906: The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files. Affects openssh across 3 version ranges.
< 7.5_p1-r8
< 66bf74a92131b7effe49fb0eefe5225151869dc5
< a6981567e8e215acc1ef690c8dbb30f2d9b00a19
Fixed in 7.5_p1-r8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is an open-source implementation of the SSH protocol suite, providing secure remote access and file transfer capabilities. It is widely used in various operating systems and is known for its robust security features. However, a vulnerability identified as CVE-2017-15906 affects OpenSSH versions prior to 7.6. This vulnerability allows attackers to create zero-length files by bypassing the readonly mode, potentially leading to unauthorized modifications or denial of service.
Vulnerability Detail
The vulnerability arises from a flaw in the process_open function within the sftp-server.c file of OpenSSH. This function fails to adequately prevent write operations when the server is in readonly mode. As a result, attackers can exploit this weakness to create zero-length files, bypassing the intended restrictions. This can have various consequences, including unauthorized modifications to sensitive files or exhausting disk space with numerous empty files.
How To Fix
Minimum fixed version
7.5_p1-r8
This is the first release that contains the fix.
sudo apk add --upgrade opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually enforce readonly permissions on the OpenSSH server configuration. This can be achieved by modifying the server configuration file (typically located at /etc/ssh/sshd_config) and adding the 'ForceCommand internal-sftp -u 022' directive. This ensures that the server only allows SFTP operations and restricts write access. After making the changes, the OpenSSH server should be restarted for the modifications to take effect.
Conclusion
The vulnerability CVE-2017-15906 in OpenSSH allows attackers to create zero-length files by bypassing readonly mode. To mitigate this issue, it is crucial to update OpenSSH to version 7.6 or later. Additionally, enforcing readonly permissions on the server configuration can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is an open-source implementation of the SSH protocol suite, providing secure remote access and file transfer capabilities.
The vulnerability allows attackers to create zero-length files, potentially leading to unauthorized modifications or denial of service.
OpenSSH versions prior to 7.6 are affected by this vulnerability.
To fix this vulnerability, update OpenSSH to version 7.6 or later.
Yes, you can enforce readonly permissions on the OpenSSH server configuration as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
