PublicDateAtUSN: 2019-01-14
Candidate: CVE-2019-6111
PublicDate: 2019-01-31 18:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111
 https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
 https://lists.mindrot.org/pipermail/openssh-unix-dev/2019-January/037459.html
 https://ubuntu.com/security/notices/USN-3885-1
 https://ubuntu.com/security/notices/USN-3885-2
Description:
 An issue was discovered in OpenSSH 7.9. Due to the scp implementation being
 derived from 1983 rcp, the server chooses which files/directories are sent
 to the client. However, the scp client only performs cursory validation of
 the object name returned (only directory traversal attacks are prevented).
 A malicious scp server (or Man-in-The-Middle attacker) can overwrite
 arbitrary files in the scp client target directory. If recursive operation
 (-r) is performed, the server can manipulate subdirectories as well (for
 example, to overwrite the .ssh/authorized_keys file).
Ubuntu-Description:
Notes:
 seth-arnold> openssh-ssh1 is provided for compatibility with old devices that
  cannot be upgraded to modern protocols. Thus we may not provide security
  support for this package if doing so would prevent access to equipment.
 mdeslaur>
 mdeslaur> The recommended workaround for this issue is to switch to using
 mdeslaur> sftp instead of scp.
 mdeslaur>
 mdeslaur> The updates in USN-3885-1 inverted two CVE numbers by accident.
 mdeslaur>
 mdeslaur> The initial USN was incomplete and did not include the second
 mdeslaur> commit.
Bugs:
Priority: low
Discovered-by: Harry Sintonen
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N [5.9 MEDIUM]

Patches_openssh:
 upstream: https://github.com/openssh/openssh-portable/commit/391ffc4b9d31fa1f4ad566499fef9176ff8a07dc
 upstream: https://github.com/openssh/openssh-portable/commit/3d896c157c722bc47adca51a58dca859225b5874
upstream_openssh: needs-triage
precise/esm_openssh: ignored (end of ESM support, was needed)
trusty_openssh: released (1:6.6p1-2ubuntu2.13)
trusty/esm_openssh: released (1:6.6p1-2ubuntu2.13)
xenial_openssh: released (1:7.2p2-4ubuntu2.8)
esm-infra/xenial_openssh: released (1:7.2p2-4ubuntu2.8)
fips/xenial_openssh: released (1:7.2p2-4ubuntu2.8)
fips-updates/xenial_openssh: released (1:7.2p2-4ubuntu2.8)
bionic_openssh: released (1:7.6p1-4ubuntu0.3)
fips/bionic_openssh: released (1:7.6p1-4ubuntu0.3)
fips-updates/bionic_openssh: released (1:7.6p1-4ubuntu0.3)
cosmic_openssh: released (1:7.7p1-4ubuntu0.3)
disco_openssh: not-affected (1:7.9p1-10)
eoan_openssh: not-affected (1:7.9p1-10)
focal_openssh: not-affected (1:7.9p1-10)
fips/focal_openssh: not-affected (1:7.9p1-10)
fips-updates/focal_openssh: not-affected (1:7.9p1-10)
groovy_openssh: not-affected (1:7.9p1-10)
hirsute_openssh: not-affected (1:7.9p1-10)
impish_openssh: not-affected (1:7.9p1-10)
jammy_openssh: not-affected (1:7.9p1-10)
devel_openssh: not-affected (1:7.9p1-10)

Patches_openssh-ssh1:
upstream_openssh-ssh1: ignored (frozen on openssh 7.5p)
precise/esm_openssh-ssh1: DNE
trusty_openssh-ssh1: DNE
trusty/esm_openssh-ssh1: DNE
xenial_openssh-ssh1: DNE
bionic_openssh-ssh1: needs-triage
cosmic_openssh-ssh1: ignored (reached end-of-life)
disco_openssh-ssh1: ignored (reached end-of-life)
eoan_openssh-ssh1: ignored (reached end-of-life)
focal_openssh-ssh1: needs-triage
groovy_openssh-ssh1: ignored (reached end-of-life)
hirsute_openssh-ssh1: ignored (reached end-of-life)
impish_openssh-ssh1: needs-triage
jammy_openssh-ssh1: needs-triage
devel_openssh-ssh1: needs-triage