Exploitation Summary
EIP tracks 1 public exploit for CVE-2000-0992. PoCs published by Michal Zalewski.
AI-analyzed exploit summary This exploit demonstrates a path traversal vulnerability in scp 1.2.x, where a malicious server can overwrite arbitrary files on the client by sending manipulated filenames. The PoC replaces the server-side scp binary to create a setuid file in /tmp on the client.
Description
Directory traversal vulnerability in scp in sshd 1.2.xx allows a remote malicious scp server to overwrite arbitrary files via a .. (dot dot) attack.
Exploits (1)
This exploit demonstrates a path traversal vulnerability in scp 1.2.x, where a malicious server can overwrite arbitrary files on the client by sending manipulated filenames. The PoC replaces the server-side scp binary to create a setuid file in /tmp on the client.