PT-2019-4678 · Sun+1 · Sun Zfs Storage Appliance Kit+1
Published
2019-01-10
·
Updated
2020-01-15
·
CVE-2018-20684
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Sun ZFS Storage Appliance Kit (AK) (affected versions not specified)
WinSCP versions prior to 5.14 beta
Description
The issue is related to insufficient input validation. In the case of WinSCP, this affects the TSCPFileSystem::SCPSink in core/ScpFileSystem.cpp, allowing a server to send arbitrary files that could potentially overwrite unrelated files on the client side. This could allow a remote attacker to gain full control over the application.
Recommendations
For Sun ZFS Storage Appliance Kit (AK), at the moment, there is no information about a newer version that contains a fix for this vulnerability.
For WinSCP versions prior to 5.14 beta, update to version 5.14 beta or later to resolve the issue. As a temporary workaround, consider restricting access to the
TSCPFileSystem::SCPSink function in core/ScpFileSystem.cpp until a patch is available. Avoid using the scp implementation in WinSCP until the issue is resolved.RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sun Zfs Storage Appliance Kit
Winscp