File Overwrite Vulnerability in OpenSSH 8.2 Scp Client

CVE-2020-12062

Summary

The scp client in OpenSSH 8.2 exhibits a vulnerability that allows a malicious unprivileged user on a remote server to overwrite files in the client's download directory. This occurs due to the improper handling of responses during the utimes system call. If a victim employs the 'scp -rp' command to download a file hierarchy and the hierarchy contains a crafted subdirectory created by the attacker, this can lead to unintended file manipulation. Although the vendor notes that this exploit requires the attacker to have certain permissions under the scp protocol, it still poses a potential risk to users.

References