PT-2007-1015 · Scponly · Scponly
Published
2007-12-14
·
Updated
2008-09-05
·
CVE-2007-6415
CVSS v2.0
8.5
High
| Vector | AV:N/AC:M/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
scponly versions 4.6 and earlier
scponly versions prior to 4.8
Description:
The issue allows remote authenticated users to bypass intended restrictions and execute arbitrary code by invoking scp with the -F and -o options. Multiple vulnerabilities in the scponly package can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited by a remote attacker who has passed the authentication procedure.
Recommendations:
For scponly versions 4.6 and earlier, update to a version later than 4.6 to resolve the issue.
For scponly versions prior to 4.8, update to version 4.8 or later to fix the vulnerabilities.
As a temporary workaround, consider restricting the use of the scp command with the -F and -o options until a patch is available.
Exploit
Fix
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Scponly