File Overwrite Vulnerability in OpenSSH Affecting Multiple Platforms

CVE-2019-6111

Summary

A vulnerability in the scp implementation of OpenSSH 7.9 allows a malicious scp server or a Man-in-the-Middle attacker to overwrite arbitrary files in the target directory of the scp client. Since scp is derived from the older rcp command from 1983, the server controls which files are sent. The client conducts limited validation of filenames, preventing only directory traversal attacks. Consequently, this flaw can be exploited to overwrite critical files, such as .ssh/authorized_keys, particularly during recursive operations.

References