Executive Summary
| Summary | |
|---|---|
| Title | openssh vulnerability |
| Informations | |||
|---|---|---|---|
| Name | USN-255-1 | First vendor Publication | 2006-02-21 |
| Vendor | Ubuntu | Last vendor Modification | 2006-02-21 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 4.6 | Attack Range | Local |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog) Ubuntu 5.10 (Breezy Badger) The following packages are affected: openssh-client The problem can be corrected by upgrading the affected package to version 1:3.8.1p1-11ubuntu3.3 (for Ubuntu 4.10), 1:3.9p1-1ubuntu2.2 (for Ubuntu 5.04), or 1:4.1p1-7ubuntu4.1 (for Ubuntu 5.10). In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: Tomas Mraz discovered a shell code injection flaw in scp. When doing local-to-local or remote-to-remote copying, scp expanded shell escape characters. By tricking an user into using scp on a specially crafted file name (which could also be caught by using an innocuous wild card like '*'), an attacker could exploit this to execute arbitrary shell commands with the privilege of that user. Please be aware that scp is not designed to operate securely on untrusted file names, since it needs to stay compatible with rcp. Please use sftp for automated systems and potentially untrusted file names. |
Original Source
| Url : http://www.ubuntu.com/usn/USN-255-1 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:1138 | |||
| Oval ID: | oval:org.mitre.oval:def:1138 | ||
| Title: | Security Vulnerability Relating to scp(1) Command May Allow Attackers to Execute Arbitrary Commands | ||
| Description: | scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-0225 | Version: | 3 |
| Platform(s): | Sun Solaris 9 Sun Solaris 10 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9962 | |||
| Oval ID: | oval:org.mitre.oval:def:9962 | ||
| Title: | scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice. | ||
| Description: | scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-0225 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-02-03 | Name : Solaris Update for Kernel 122300-48 File : nvt/gb_solaris_122300_48.nasl |
| 2010-02-03 | Name : Solaris Update for Kernel 122301-48 File : nvt/gb_solaris_122301_48.nasl |
| 2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
| 2009-10-13 | Name : Solaris Update for /usr/bin/ssh 114356-19 File : nvt/gb_solaris_114356_19.nasl |
| 2009-10-13 | Name : Solaris Update for /usr/bin/ssh 114357-18 File : nvt/gb_solaris_114357_18.nasl |
| 2009-10-10 | Name : SLES9: Security update for OpenSSH File : nvt/sles9p5021162.nasl |
| 2009-06-03 | Name : Solaris Update for /usr/bin/ssh 114356-18 File : nvt/gb_solaris_114356_18.nasl |
| 2009-06-03 | Name : Solaris Update for /usr/bin/ssh 114357-17 File : nvt/gb_solaris_114357_17.nasl |
| 2009-06-03 | Name : Solaris Update for kernel 120011-14 File : nvt/gb_solaris_120011_14.nasl |
| 2009-06-03 | Name : Solaris Update for kernel 120012-14 File : nvt/gb_solaris_120012_14.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200602-11 (OpenSSH) File : nvt/glsa_200602_11.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2006-045-06 openssh File : nvt/esoft_slk_ssa_2006_045_06.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 22692 | OpenSSH scp Command Line Filename Processing Command Injection OpenSSH contains a flaw that may allow an attacker to execute arbitrary commands. The flaw is due to the way OpenSSH's scp utility handles file names during local-to-local copies. During the file name expansion, the utility does not properly sanitize filenames allowing a crafted file name with shell meta-characters. This can be used to trick a user into executing arbitrary commands under with a different set of (potentially higher) privileges. |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2012-08-16 | IAVM : 2012-A-0136 - Multiple Vulnerabilities in Juniper Network Management Products Severity : Category I - VMSKEY : V0033662 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-09-13 | Name : The remote host is affected by multiple vulnerabilities. File : juniper_nsm_2012_1.nasl - Type : ACT_GATHER_INFO |
| 2011-10-04 | Name : The version of SSH running on the remote host has a command injection vulnera... File : openssh_43.nasl - Type : ACT_GATHER_INFO |
| 2011-08-29 | Name : The SSH service running on the remote host has an information disclosure vuln... File : sunssh_plaintext_recovery.nasl - Type : ACT_GATHER_INFO |
| 2007-03-13 | Name : The remote host is missing a Mac OS X update which fixes a security issue. File : macosx_10_4_9.nasl - Type : ACT_GATHER_INFO |
| 2006-09-29 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0698.nasl - Type : ACT_GATHER_INFO |
| 2006-08-04 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0298.nasl - Type : ACT_GATHER_INFO |
| 2006-07-21 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0298.nasl - Type : ACT_GATHER_INFO |
| 2006-07-05 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0044.nasl - Type : ACT_GATHER_INFO |
| 2006-03-13 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-255-1.nasl - Type : ACT_GATHER_INFO |
| 2006-03-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0044.nasl - Type : ACT_GATHER_INFO |
| 2006-02-21 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200602-11.nasl - Type : ACT_GATHER_INFO |
| 2006-02-15 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2006-045-06.nasl - Type : ACT_GATHER_INFO |
| 2006-02-15 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_008.nasl - Type : ACT_GATHER_INFO |
| 2006-02-10 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-034.nasl - Type : ACT_GATHER_INFO |
| 2006-01-24 | Name : The remote Fedora Core host is missing a security update. File : fedora_2006-056.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 12:03:19 |
|
