PT-2020-6183 · Openssh +2 · Openssh +2

Published

2020-06-01

·

Updated

2024-08-04

·

CVE-2020-12062

CVSS v2.0
7.8
VectorAV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions:

OpenSSH version 8.2

Description:

The issue arises from the scp client in OpenSSH incorrectly sending duplicate responses to the server upon a utimes system call failure. This allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. It is noted that this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol and utimes does not fail under normal circumstances.

Recommendations:

As a temporary workaround, consider restricting the use of the scp -rp command until a patch is available.

Avoid using the scp client to download file hierarchies from untrusted sources.

Restrict access to the download directory to minimize the risk of exploitation.

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2024-3921
ALT-PU-2024-4077
ALT-PU-2024-4467
BDU:2021-03493
CVE-2020-12062

Affected Products

Alt Linux
Astra Linux
Openssh