PT-2021-9085 · Git+19 · Krb5-Appl+5

Karol Babioch · Published 2021-02-02 · Updated 2021-07-21 · CVE-2019-25017

OSV

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious rcp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rcp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized keys file). This issue is similar to CVE-2019-6111 and CVE-2019-7283 (CVE-2019-25017).

In the rcp client in MIT krb5-appl through 1.0.3 malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side (CVE-2019-25018).

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2019-25017

MGASA-2021-0196

SUSE-SU-2021:0527-1

SUSE-SU-2021_0527-1

Affected Products

Krb5-Appl

Krb5-Appl-Clients

Krb5-Appl-Clients-Debuginfo

Krb5-Appl-Debugsource

Krb5-Appl-Servers

Krb5-Appl-Servers-Debuginfo

References · 16

• 🔥 https://bugzilla.suse.com/show_bug.cgi?id=1131109 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25017 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0196 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0196.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:0527-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-25017 · Vendor Advisory
• https://suse.com/security/cve/CVE-2019-25018.html · Note
• https://bugs.mageia.org/show_bug.cgi?id=28460 · Note
• https://suse.com/security/cve/CVE-2019-25017 · Note
• https://bugzilla.suse.com/1131109 · Note
• https://suse.com/security/cve/CVE-2019-25018 · Note
• https://lists.suse.com/pipermail/sle-security-updates/2021-February/008353.html · Note
• https://t.me/cibsecurity/22961 · Telegram Post
• https://suse.com/security/cve/CVE-2019-25017.html · Note
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Note