Critical Vulnerability in OpenSSH: Arbitrary File Overwrite Risk
Summary
ALPINE-CVE-2019-6111: An issue was discovered in OpenSSH 7.9. Affects openssh versions < 7.9_p1-r3. Fixed in 7.9_p1-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used implementation of the SSH (Secure Shell) protocol, providing secure remote access and file transfer capabilities. It is known for its robust security features and is integral to many systems for secure communications. However, a vulnerability has been identified in its SCP (Secure Copy Protocol) implementation, which can lead to serious security risks if exploited.
Vulnerability Detail
An issue was discovered in OpenSSH 7.9, where the SCP implementation, derived from the 1983 RCP protocol, allows a malicious SCP server or a Man-in-The-Middle attacker to overwrite arbitrary files in the target directory of the SCP client. The vulnerability arises from the server's ability to choose which files and directories are sent to the client, while the SCP client only performs minimal validation on the object names returned. This oversight can lead to unauthorized file modifications, especially if recursive operations are performed, potentially compromising sensitive files such as .ssh/authorized_keys.
How To Fix
Minimum fixed version
7.9_p1-r3
This is the first release that contains the fix.
sudo apk add --upgrade opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling SCP or using alternative secure file transfer methods until the patch is applied. Additionally, ensure that your SCP server is trusted and that you are aware of the files being transferred.
Conclusion
The vulnerability in OpenSSH's SCP implementation poses a significant risk of arbitrary file overwrites, which can lead to unauthorized access and system compromise. It is crucial to update to the patched version to mitigate this risk and ensure the security of your systems.
See every vulnerability recorded for openssh →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can allow attackers to overwrite critical files on the client system, leading to unauthorized access and potential system compromise.
Yes, you can temporarily disable SCP or use alternative secure file transfer methods to mitigate the risk until the patch is applied.
OpenSSH versions prior to 7.9_p1-r3 are affected by this vulnerability. Ensure you are using the patched version to avoid risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
