CVE-2018-20685
Medium
Description
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Openbsd Openssh
PublishedJan 10, 2019
First seenJan 10, 2019
Weakness typeCWE-863Incorrect authorization
How to fix
Update
- fujitsu m10-1_firmwarexcp2361, xcp3070 or later
- fujitsu m10-4_firmwarexcp2361, xcp3070 or later
- fujitsu m10-4s_firmwarexcp2361, xcp3070 or later
- fujitsu m12-1_firmwarexcp2361, xcp3070 or later
- fujitsu m12-2_firmwarexcp2361, xcp3070 or later
- fujitsu m12-2s_firmwarexcp2361, xcp3070 or later
- siemens scalance_x204rna_firmware3.2.7 or later
- siemens scalance_x204rna_eec_firmware3.2.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openbsd openssh | v ≤ 7.9 | — |
| winscp winscp | v ≤ 5.13 | — |
| netapp cloud_backup | No range specified | — |
| netapp element_software | No range specified | — |
| netapp ontap_select_deploy | No range specified | — |
| netapp steelstore_cloud_integrated_storage | No range specified | — |
| netapp storage_automation_store | No range specified | — |
| debian debian_linux | 8.0, 9.0 | — |
| canonical ubuntu_linux | 14.04, 16.04, 18.04, 18.10 | — |
| redhat enterprise_linux | 7.0, 8.0 | — |
| redhat enterprise_linux_eus | 8.1, 8.2, 8.4, 8.6 | — |
| redhat enterprise_linux_server_aus | 8.2, 8.4, 8.6 | — |
| redhat enterprise_linux_server_tus | 8.2, 8.4, 8.6 | — |
| oracle solaris | 10 | — |
| fujitsu m10-1_firmware | v < xcp2361, v < xcp3070 | xcp2361, xcp3070 |
| fujitsu m10-4_firmware | v < xcp2361, v < xcp3070 | xcp2361, xcp3070 |
| fujitsu m10-4s_firmware | v < xcp2361, v < xcp3070 | xcp2361, xcp3070 |
| fujitsu m12-1_firmware | v < xcp2361, v < xcp3070 | xcp2361, xcp3070 |
| fujitsu m12-2_firmware | v < xcp2361, v < xcp3070 | xcp2361, xcp3070 |
| fujitsu m12-2s_firmware | v < xcp2361, v < xcp3070 | xcp2361, xcp3070 |
| siemens scalance_x204rna_firmware | v < 3.2.7 | 3.2.7 |
| siemens scalance_x204rna_eec_firmware | v < 3.2.7 | 3.2.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.