PT-2017-4046 · Jcraft · Jsch

Published 2016-09-21 · Updated 2022-05-13 · CVE-2016-5725

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions JCraft JSch versions prior to 0.1.54

Description The issue allows remote SFTP servers to write to arbitrary files via a .. (dot dot backslash) in a response to a recursive GET command, potentially impacting the integrity of information. This is due to incorrect restriction of the directory path name with limited access.

Recommendations For versions prior to 0.1.54, update to version 0.1.54 or later to resolve the issue. As a temporary workaround, consider restricting access to the ChannelSftp.OVERWRITE mode until a patch is available. Avoid using the ChannelSftp.OVERWRITE mode in the affected JSch implementation until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2021-00681

CVE-2016-5725

DLA-2184-1

DLA-611-1

GHSA-Q446-82VQ-W674

MGASA-2016-0311

SUSE-SU-2017:0715-1

Affected Products

Jsch

References · 27

• 🔥 https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-5725 · Exploit
• 🔥 https://exploit-db.com/exploits/40411 · Exploit
• https://bdu.fstec.ru/vul/2021-00681 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-5725 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-5725 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q446-82vq-w674 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3115 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0311.html · Security Note
• https://osv.dev/vulnerability/CVE-2016-5725 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:0715-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-5725 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0311 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2184-1 · Vendor Advisory
• http://securityfocus.com/bid/93100 · Note
• https://bugs.mageia.org/show_bug.cgi?id=19296 · Note