PT-2019-6235 · Netkit · Netkit

Published 2019-01-26 · Updated 2023-07-15 · CVE-2019-7283

Positive Technologies (AI Summary)

CVSS v2.0

8.8

High

Base vector

AV:N/AC:M/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions NetKit versions through 0.17

Description The issue allows a malicious rsh server or a Man-in-The-Middle attacker to overwrite arbitrary files in a directory on the rcp client machine due to the rcp client only performing cursory validation of the object name returned by the server. This can lead to data integrity compromise and potentially cause a denial of service.

Recommendations For NetKit versions through 0.17, as a temporary workaround, consider restricting access to the rcp operation until a patch is available. Additionally, restrict the use of the rsh server to trusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2022-05872

CVE-2019-7283

DLA-2822-1

MGASA-2021-0525

Affected Products

Netkit

References · 23

• 🔥 https://bugs.debian.org/920486 · Exploit
• https://bdu.fstec.ru/vul/2022-05872 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-7283 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-7283 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-7283 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0525.html · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0525 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-7283 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-7283 · Security Note
• https://debian.org/lts/security/2021/dla-2822 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2822-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-7283 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-7283 · Vendor Advisory