CVE-2018-20685

MEDIUM EXPLOITED IN THE WILD RANSOMWARE

OpenSSH < 7.9 - Incorrect Authorization via SCP Filename Manipulation

Title source: llm

Exploitation Summary

CVE-2018-20685 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io), including in ransomware campaigns.

Description

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.

References (14)

Core 14

Core References

Patch, Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Patch

https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.197&r2=1.198&f=h

Patch

https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2

View Patch ZIP pw:eip

Third Party Advisory

https://security.netapp.com/advisory/ntap-20190215-0001/

Patch, Third Party Advisory

https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt

Patch, Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Patch, Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html