CVE-2000-0992
published 2000-12-19CVE-2000-0992: Directory traversal vulnerability in scp in sshd 1.2.xx allows a remote malicious scp server to overwrite arbitrary files via a .. (dot dot) attack.
PriorityP427medium5CVSS 2.0
AVNACLAuNCNIPAN
EXPLOIT
EPSS
6.05%
93.4th percentile
Directory traversal vulnerability in scp in sshd 1.2.xx allows a remote malicious scp server to overwrite arbitrary files via a .. (dot dot) attack.
Affected
40 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openssh | < openssh 1:3.9p1-1 (bookworm) | openssh 1:3.9p1-1 (bookworm) |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | — | — |
| openbsd | openssh | >= 0 < 1:3.9p1-1 | 1:3.9p1-1 |
| openbsd | openssh | >= 0 < 1:3.9p1-1 | 1:3.9p1-1 |
| openbsd | openssh | >= 0 < 1:3.9p1-1 | 1:3.9p1-1 |
| openbsd | openssh | >= 0 < 1:3.9p1-1 | 1:3.9p1-1 |
| ssh | ssh | — | — |
| ssh | ssh | — | — |
| ssh | ssh | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_debian5.0LOW
vendor_redhat5.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
SSH/OpenSSH scp Server path traversal (EDB-20253 / Nessus ID 11339)
vuldb·2026-09-24·CVSS 5.0
CVE-2000-0992 [MEDIUM] SSH/OpenSSH scp Server path traversal (EDB-20253 / Nessus ID 11339)
A vulnerability was found in SSH and OpenSSH and classified as problematic. Affected is an unknown function of the component scp Server. Such manipulation leads to path traversal.
This vulnerability is uniquely identified as CVE-2000-0992. The attack can be launched remotely. Moreover, an exploit is present.
It is suggested to upgrade the affected component.
GHSA
GHSA-384q-pv6w-p8vv: Directory traversal vulnerability in scp for OpenSSH before 3
ghsa_unreviewed·2022-05-03·CVSS 5.0
CVE-2004-0175 [MEDIUM] CWE-22 GHSA-384q-pv6w-p8vv: Directory traversal vulnerability in scp for OpenSSH before 3
Directory traversal vulnerability in scp for OpenSSH before 3.4p1 allows remote malicious servers to overwrite arbitrary files. NOTE: this may be a rediscovery of CVE-2000-0992.
GHSA
GHSA-vx4v-hfcq-7vw7: Directory traversal vulnerability in scp in sshd 1
ghsa_unreviewed·2022-04-30
CVE-2000-0992 [MEDIUM] GHSA-vx4v-hfcq-7vw7: Directory traversal vulnerability in scp in sshd 1
Directory traversal vulnerability in scp in sshd 1.2.xx allows a remote malicious scp server to overwrite arbitrary files via a .. (dot dot) attack.
OSV
CVE-2004-0175: Directory traversal vulnerability in scp for OpenSSH before 3
osv·2004-08-18·CVSS 5.0
CVE-2004-0175 [MEDIUM] CVE-2004-0175: Directory traversal vulnerability in scp for OpenSSH before 3
Directory traversal vulnerability in scp for OpenSSH before 3.4p1 allows remote malicious servers to overwrite arbitrary files. NOTE: this may be a rediscovery of CVE-2000-0992.
OSV
CVE-2000-0992: Directory traversal vulnerability in scp in sshd 1
osv·2000-12-19·CVSS 5.0
CVE-2000-0992 [MEDIUM] CVE-2000-0992: Directory traversal vulnerability in scp in sshd 1
Directory traversal vulnerability in scp in sshd 1.2.xx allows a remote malicious scp server to overwrite arbitrary files via a .. (dot dot) attack.
Debian
CVE-2004-0175: openssh - Directory traversal vulnerability in scp for OpenSSH before 3.4p1 allows remote ...
vendor_debian·2004·CVSS 5.0
CVE-2004-0175 [MEDIUM] CVE-2004-0175: openssh - Directory traversal vulnerability in scp for OpenSSH before 3.4p1 allows remote ...
Directory traversal vulnerability in scp for OpenSSH before 3.4p1 allows remote malicious servers to overwrite arbitrary files. NOTE: this may be a rediscovery of CVE-2000-0992.
Scope: local
bookworm: resolved (fixed in 1:3.9p1-1)
bullseye: resolved (fixed in 1:3.9p1-1)
forky: resolved (fixed in 1:3.9p1-1)
sid: resolved (fixed in 1:3.9p1-1)
trixie: resolved (fixed in 1:3.9p1-1)
Red Hat
security flaw
vendor_redhat·2000-09-01·CVSS 5.0
CVE-2004-0175 [MEDIUM] security flaw
security flaw
Directory traversal vulnerability in scp for OpenSSH before 3.4p1 allows remote malicious servers to overwrite arbitrary files. NOTE: this may be a rediscovery of CVE-2000-0992.
Statement: Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
Debian
CVE-2000-0992: openssh - Directory traversal vulnerability in scp in sshd 1.2.xx allows a remote maliciou...
vendor_debian·2000·CVSS 5.0
CVE-2000-0992 [MEDIUM] CVE-2000-0992: openssh - Directory traversal vulnerability in scp in sshd 1.2.xx allows a remote maliciou...
Directory traversal vulnerability in scp in sshd 1.2.xx allows a remote malicious scp server to overwrite arbitrary files via a .. (dot dot) attack.
Scope: local
bookworm: resolved (fixed in 1:3.9p1-1)
bullseye: resolved (fixed in 1:3.9p1-1)
forky: resolved (fixed in 1:3.9p1-1)
sid: resolved (fixed in 1:3.9p1-1)
trixie: resolved (fixed in 1:3.9p1-1)
No detection rules found.
http://archives.neohapsis.com/archives/bugtraq/2000-09/0359.htmlhttp://frontal2.mandriva.com/security/advisories?name=MDKSA-2000:057http://www.securityfocus.com/bid/1742https://exchange.xforce.ibmcloud.com/vulnerabilities/5312http://archives.neohapsis.com/archives/bugtraq/2000-09/0359.htmlhttp://frontal2.mandriva.com/security/advisories?name=MDKSA-2000:057http://www.securityfocus.com/bid/1742https://exchange.xforce.ibmcloud.com/vulnerabilities/5312
2000-12-19
Published