In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.

Mitigation

This issue only affects the users of scp binary which is a part of openssh-clients package. Other usage of SSH protocol or other ssh clients is not affected. Administrators can uninstall openssh-clients for additional protection against accidental usage of this binary. Removing the openssh-clients package will make binaries like scp and ssh etc unavailable on that system.

Note: To exploit this flaw, the victim needs to connect to a malicious SSH server or MITM (Man-in-the-middle) the scp connection, both of which can be detected by the system administrator via a change in the host key of the SSH server. Further, if connections via scp are made to only trusted SSH servers, then those use-cases are not vulnerable to this security flaw.

References

bugzilla.redhat.com/show_bug.cgi?id=1665785

www.cve.org/CVERecord?id=CVE-2018-20685 https://nvd.nist.gov/vuln/detail/CVE-2018-20685 https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt

fedora 2

nessus 43

openvas 23

attackerkb 1

debiancve 3

cve 4

f5 2

nvd 4

prion 4

cvelist 4

ubuntucve 4

osv 5