CVE-2019-6111
published 2019-01-31CVE-2019-6111: An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the…
PriorityP185medium5.9CVSS 3.1
AVNACHPRNUINSUCNIHAN
ITWEXPLOITVulnCheck KEVRansomware
Exploited in the wild
EPSS
58.20%
99.0th percentile
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
Affected
57 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | mina_sshd | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | libssh | < libssh 0.12.0-1 (forky) | libssh 0.12.0-1 (forky) |
| debian | netkit-rsh | < netkit-rsh 0.17-20 (bookworm) | netkit-rsh 0.17-20 (bookworm) |
| debian | openssh | < openssh 1:7.9p1-9 (bookworm) | openssh 1:7.9p1-9 (bookworm) |
| fedoraproject | fedora | — | — |
| freebsd | freebsd | < 12.0 | 12.0 |
| freebsd | freebsd | — | — |
| fujitsu | m10-1_firmware | < xcp2361 | xcp2361 |
| fujitsu | m10-1_firmware | < xcp3070 | xcp3070 |
| fujitsu | m10-4_firmware | < xcp2361 | xcp2361 |
| fujitsu | m10-4_firmware | < xcp3070 | xcp3070 |
| fujitsu | m10-4s_firmware | < xcp2361 | xcp2361 |
| fujitsu | m10-4s_firmware | < xcp3070 | xcp3070 |
| fujitsu | m12-1_firmware | < xcp2361 | xcp2361 |
| fujitsu | m12-1_firmware | < xcp3070 | xcp3070 |
| fujitsu | m12-2_firmware | < xcp2361 | xcp2361 |
| fujitsu | m12-2_firmware | < xcp3070 | xcp3070 |
| fujitsu | m12-2s_firmware | < xcp2361 | xcp2361 |
| fujitsu | m12-2s_firmware | < xcp3070 | xcp3070 |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x1b[1A
- →Detect ANSI escape sequences (specifically ESC[1A / \x1b[1A) sent over SCP stderr channel, which are used to hide the transfer of additional malicious files from the client's progress display. ↗
- →Monitor SCP sessions where the server sends multiple 'C' (copy) protocol messages for a single-file download request — the extra file transfer is the exploit payload delivery mechanism for CVE-2019-6111. ↗
- →Alert on SCP recursive (-r) operations to/from untrusted servers, especially where subdirectory manipulation could result in writes to sensitive paths like .ssh/authorized_keys. ↗
- ·The exploit PoC server accepts any username and password (no authentication enforcement), meaning the rogue server is trivially accessible to any connecting SCP client — defenders should not rely on authentication as a mitigation signal. ↗
- ·The initial patch for CVE-2019-6111 in USN-3885-1 was incomplete and required a follow-up fix in USN-3885-2; deployments that only applied the first patch may still be vulnerable. ↗
- ·The vulnerability affects PAN-OS versions before 7.1.26, 8.1.13, and 9.0.7; PAN-OS 8.0 reached end-of-life on October 31, 2019 and is no longer covered by security assurance policies. ↗
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P
osv5.9MEDIUM
vulncheck5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_redhat5.9MEDIUM
vendor_ubuntu5.9MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libssh: Improper sanitation of paths received from SCP servers
vendor_redhat·2026-02-10·CVSS 5.9
CVE-2026-0964 [MEDIUM] CWE-22 libssh: Improper sanitation of paths received from SCP servers
libssh: Improper sanitation of paths received from SCP servers
A malicious SCP server can send unexpected paths that could make the
client application override local files outside of working directory.
This could be misused to create malicious executable or configuration
files and make the user execute them under specific consequences.
This is the same issue as in OpenSSH, tracked as CVE-2019-6111.
A malicious SCP server can send unexpected paths that could make the
client application override local files outside of working directory.
This could be misused to create malicious executable or configuration
files and make the user execute them under specific consequences.
This is the same issue as in OpenSSH, tracked as CVE-2019-6111.
Mitigation: Do not use SCP! SCP is deprecated for severa
Debian
CVE-2026-0964: libssh - A malicious SCP server can send unexpected paths that could make the client appl...
vendor_debian·2026·CVSS 5.9
CVE-2026-0964 [MEDIUM] CVE-2026-0964: libssh - A malicious SCP server can send unexpected paths that could make the client appl...
A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue as in OpenSSH, tracked as CVE-2019-6111.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 0.12.0-1)
sid: resolved (fixed in 0.12.0-1)
trixie: open
Palo Alto
PAN-SA-2024-0003 Informational Bulletin: Impact of OSS CVEs in Prisma SD-WAN ION
vendor_paloalto·2024-04-05·CVSS 4.3
CVE-2007-2768 [MEDIUM] PAN-SA-2024-0003 Informational Bulletin: Impact of OSS CVEs in Prisma SD-WAN ION
PAN-SA-2024-0003 Informational Bulletin: Impact of OSS CVEs in Prisma SD-WAN ION
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to Prisma SD-WAN ION. While Prisma SD-WAN ION may include the
CVEs: CVE-2007-2768, CVE-2016-10010, CVE-2016-10011, CVE-2016-10012, CVE-2016-20012, CVE-2016-8858, CVE-2019-6109, CVE-2019-6110, CVE-2019-6111, CVE-2020-12062, CVE-2021-41617, CVE-2022-4450, CVE-2023-0215, CVE-2023-0286, CVE-2023-28531, CVE-2023-38408, CVE-2023-51384, CVE-2023-51385, CVE-2023-51767
Affected products: Prisma SD
CISA ICS
Siemens SCALANCE X-200RNA Switch Devices
cisa_ics·2022-12-19
Siemens SCALANCE X-200RNA Switch Devices
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SCALANCE X-200RNA Switch Devices
Last RevisedDecember 19, 2022
Alert CodeICSA-22-349-21
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity/public exploits are available
- Vendor: Siemens
- Equipment: SCALANCE X-200RNA switch devices before V3.2.7
- Vulnerabilities: Observable Timing Discrepancy; Race Condition; Improper Restriction of Operations within the Bounds of a Memory Buffer; Improper Input Validation; NULL Pointer Dereference; Use After Free; Cryptographic Issues; Comparison of Incompatible Types; Resource Management
Red Hat
krb5-appl: Improper validation of object names allows malicious server to overwrite files via rcp client
vendor_redhat·2021-02-02·CVSS 5.9
CVE-2019-25017 [MEDIUM] CWE-20 krb5-appl: Improper validation of object names allows malicious server to overwrite files via rcp client
krb5-appl: Improper validation of object names allows malicious server to overwrite files via rcp client
An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious rcp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rcp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). This issue is similar to CVE-2019-6111 and CVE-2019-7283. NOTE: MIT krb5-appl is not supported upst
Palo Alto
PAN-SA-2020-0002 PAN-OS: OpenSSH software upgraded to resolve multiple vulnerabilities
vendor_paloalto·2020-04-08·CVSS 5.3
[MEDIUM] CWE-20 PAN-SA-2020-0002 PAN-OS: OpenSSH software upgraded to resolve multiple vulnerabilities
PAN-SA-2020-0002 PAN-OS: OpenSSH software upgraded to resolve multiple vulnerabilities
OpenSSH software included with PAN-OS has been upgraded to resolve multiple vulnerabilities. These issue affects Palo Alto Networks PAN-OS 7.1 versions before 7.1.26; 8.1 versions before 8.1.13; 9.0 versions before 9.0.7. PAN-OS 8.0 is now end-of-life as of October 31, 2019, and is no longer covered by our Product Security Assurance policies. The resolved vulnerabilities include: CVE CVSS Summary CVE-2018-20685 5.3 ( CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N ) In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side. CVE-2019-61
Ubuntu
OpenSSH vulnerability
vendor_ubuntu·2019-03-04·CVSS 5.9
CVE-2019-6111 [MEDIUM] OpenSSH vulnerability
Title: OpenSSH vulnerability
Summary: One of the fixes in USN-3885-1 was incomplete.
USN-3885-1 fixed vulnerabilities in OpenSSH. It was discovered that the fix
for CVE-2019-6111 turned out to be incomplete. This update fixes the
problem.
Original advisory details:
Harry Sintonen discovered multiple issues in the OpenSSH scp utility. If a
user or automated system were tricked into connecting to an untrusted
server, a remote attacker could possibly use these issues to write to
arbitrary files, change directory permissions, and spoof client output.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2019-02-07
CVE-2018-20685 OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
Harry Sintonen discovered multiple issues in the OpenSSH scp utility. If a
user or automated system were tricked into connecting to an untrusted
server, a remote attacker could possibly use these issues to write to
arbitrary files, change directory permissions, and spoof client output.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
netkit-rsh: possible overwrite of arbitrary files by a malicious rsh server
vendor_redhat·2019-01-31·CVSS 5.9
CVE-2019-7283 [MEDIUM] netkit-rsh: possible overwrite of arbitrary files by a malicious rsh server
netkit-rsh: possible overwrite of arbitrary files by a malicious rsh server
An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned. A malicious rsh server (or Man-in-The-Middle attacker) can overwrite arbitrary files in a directory on the rcp client machine. This is similar to CVE-2019-6111.
A vulnerability was found in rsh. The vulnerability occurs due to a possible overwrite of arbitrary files by a malicious rsh server. This flaw allows an attacker or a malicious rsh server (or a Man-in-The-Middle attacker) to overwrite arbitrary files in a directory on the rcp client machine.
Statement: Red Hat Enterprise Linux 6
Debian
CVE-2019-6111: openssh - An issue was discovered in OpenSSH 7.9. Due to the scp implementation being deri...
vendor_debian·2019·CVSS 5.9
CVE-2019-6111 [MEDIUM] CVE-2019-6111: openssh - An issue was discovered in OpenSSH 7.9. Due to the scp implementation being deri...
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
Scope: local
bookworm: resolved (fixed in 1:7.9p1-9)
bullseye: resolved (fixed in 1:7.9p1-9)
forky: resolved (fixed in 1:7.9p1-9)
sid: resolved (fixed in 1:7.9p1-9)
trixie: resolved (fixed in 1:7.9p1-9)
Debian
CVE-2019-7283: netkit-rsh - An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the...
vendor_debian·2019·CVSS 5.9
CVE-2019-7283 [MEDIUM] CVE-2019-7283: netkit-rsh - An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the...
An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned. A malicious rsh server (or Man-in-The-Middle attacker) can overwrite arbitrary files in a directory on the rcp client machine. This is similar to CVE-2019-6111.
Scope: local
bookworm: resolved (fixed in 0.17-20)
bullseye: resolved (fixed in 0.17-20)
Red Hat
openssh: Improper validation of object names allows malicious server to overwrite files via scp client
vendor_redhat·2018-11-16·CVSS 5.9
CVE-2019-6111 [MEDIUM] CWE-20 openssh: Improper validation of object names allows malicious server to overwrite files via scp client
openssh: Improper validation of object names allows malicious server to overwrite files via scp client
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
Statement: This issue affects the scp client shipped with openssh. The SSH protocol or the SSH client is not affected. For
OSV
CVE-2026-0964: A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory
osv·2026-03-26·CVSS 5.9
CVE-2026-0964 [MEDIUM] CVE-2026-0964: A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory
A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue as in OpenSSH, tracked as CVE-2019-6111.
GHSA
GHSA-9p3w-rm2q-9gxc: A malicious SCP server can send unexpected paths that could make the
client application override local files outside of working directory
ghsa_unreviewed·2026-03-26·CVSS 5.9
CVE-2026-0964 [MEDIUM] CWE-22 GHSA-9p3w-rm2q-9gxc: A malicious SCP server can send unexpected paths that could make the
client application override local files outside of working directory
A malicious SCP server can send unexpected paths that could make the
client application override local files outside of working directory.
This could be misused to create malicious executable or configuration
files and make the user execute them under specific consequences.
This is the same issue as in OpenSSH, tracked as CVE-2019-6111.
GHSA
GHSA-9wrw-gcp8-hgqx: An issue was discovered in the Amazon Linux packages of OpenSSH 7
ghsa_unreviewed·2024-04-03·CVSS 5.9
CVE-2023-35812 [MEDIUM] CWE-22 GHSA-9wrw-gcp8-hgqx: An issue was discovered in the Amazon Linux packages of OpenSSH 7
An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon Linux 1 and 2, because of an incomplete fix for CVE-2019-6111 within these specific packages. The fix had only covered cases where an absolute path is passed to scp. When a relative path is used, there is no verification that the name of a file received by the client matches the file requested. Fixed packages are available with numbers 7.4p1-22.78.amzn1 and 7.4p1-22.amzn2.0.2.
GHSA
GHSA-hj6m-8794-335m: An issue was discovered in rcp in MIT krb5-appl through 1
ghsa_unreviewed·2022-05-24·CVSS 5.9
CVE-2019-25017 [MEDIUM] GHSA-hj6m-8794-335m: An issue was discovered in rcp in MIT krb5-appl through 1
An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious rcp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rcp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). This issue is similar to CVE-2019-6111 and CVE-2019-7283. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Ker
GHSA
GHSA-2jpr-cg8h-wpp2: An issue was discovered in rcp in NetKit through 0
ghsa_unreviewed·2022-05-13·CVSS 5.9
CVE-2019-7283 [MEDIUM] GHSA-2jpr-cg8h-wpp2: An issue was discovered in rcp in NetKit through 0
An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned. A malicious rsh server (or Man-in-The-Middle attacker) can overwrite arbitrary files in a directory on the rcp client machine. This is similar to CVE-2019-6111.
GHSA
GHSA-jr78-hfw4-xp7g: An issue was discovered in OpenSSH 7
ghsa_unreviewed·2022-05-13
CVE-2019-6111 [MEDIUM] CWE-22 GHSA-jr78-hfw4-xp7g: An issue was discovered in OpenSSH 7
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
OSV
openssh vulnerability
osv·2019-03-04·CVSS 5.9
CVE-2019-6111 [MEDIUM] openssh vulnerability
openssh vulnerability
USN-3885-1 fixed vulnerabilities in OpenSSH. It was discovered that the fix
for CVE-2019-6111 turned out to be incomplete. This update fixes the
problem.
Original advisory details:
Harry Sintonen discovered multiple issues in the OpenSSH scp utility. If a
user or automated system were tricked into connecting to an untrusted
server, a remote attacker could possibly use these issues to write to
arbitrary files, change directory permissions, and spoof client output.
OSV
CVE-2019-7283: An issue was discovered in rcp in NetKit through 0
osv·2019-01-31·CVSS 5.9
CVE-2019-7283 [MEDIUM] CVE-2019-7283: An issue was discovered in rcp in NetKit through 0
An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned. A malicious rsh server (or Man-in-The-Middle attacker) can overwrite arbitrary files in a directory on the rcp client machine. This is similar to CVE-2019-6111.
OSV
CVE-2019-6111: An issue was discovered in OpenSSH 7
osv·2019-01-31·CVSS 5.9
CVE-2019-6111 [MEDIUM] CVE-2019-6111: An issue was discovered in OpenSSH 7
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
VulnCheck
OpenBSD openssh Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulncheck·2019·CVSS 5.9
CVE-2019-6111 [MEDIUM] OpenBSD openssh Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
OpenBSD openssh Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
Affected: OpenBSD openssh
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the pro
No detection rules found.
Exploit-DB
SCP Client - Multiple Vulnerabilities (SSHtranger Things)
exploitdb·2019-01-18·CVSS 6.8
CVE-2019-6111 [MEDIUM] SCP Client - Multiple Vulnerabilities (SSHtranger Things)
SCP Client - Multiple Vulnerabilities (SSHtranger Things)
---
# Exploit Title: SSHtranger Things
# Date: 2019-01-17
# Exploit Author: Mark E. Haase
# Vendor Homepage: https://www.openssh.com/
# Software Link: [download link if available]
# Version: OpenSSH 7.6p1
# Tested on: Ubuntu 18.04.1 LTS
# CVE : CVE-2019-6111, CVE-2019-6110
'''
Title: SSHtranger Things
Author: Mark E. Haase
Homepage: https://www.hyperiongray.com
Date: 2019-01-17
CVE: CVE-2019-6111, CVE-2019-6110
Advisory: https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
Tested on: Ubuntu 18.04.1 LTS, OpenSSH client 7.6p1
We have nicknamed this "SSHtranger Things" because the bug is so old it could be
exploited by an 8-bit Demogorgon. Tested on Python 3.6.7 and requires `paramiko`
package.
The server listens
Exploit-DB
OpenSSH SCP Client - Write Arbitrary Files
exploitdb·2019-01-11·CVSS 6.8
CVE-2019-6111 [MEDIUM] OpenSSH SCP Client - Write Arbitrary Files
OpenSSH SCP Client - Write Arbitrary Files
---
'''
Title: SSHtranger Things
Author: Mark E. Haase
Homepage: https://www.hyperiongray.com
Date: 2019-01-17
CVE: CVE-2019-6111, CVE-2019-6110
Advisory: https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
Tested on: Ubuntu 18.04.1 LTS, OpenSSH client 7.6p1
We have nicknamed this "SSHtranger Things" because the bug is so old it could be
exploited by an 8-bit Demogorgon. Tested on Python 3.6.7 and requires `paramiko`
package.
The server listens on port 2222. It accepts any username and password, and it
generates a new host key every time you run it.
$ python3 sshtranger_things.py
Download a file using a vulnerable client. The local path must be a dot:
$ scp -P 2222 foo@localhost:test.txt .
The authenticity of host '[local
CTF
20190622-googlectfquals / README
ctf_writeups·2019
20190622-googlectfquals / README
# Google CTF Quals 2019
**It's recommended to read our responsive [web version](https://balsn.tw/ctf_writeup/20190622-googlectfquals/) of this writeup.**
- [Google CTF Quals 2019](#google-ctf-quals-2019)
- [Reverse](#reverse)
- [Malvertising](#malvertising)
- [First stage](#first-stage)
- [Second stage](#second-stage)
- [Third stage](#third-stage)
- [Flaggy Bird](#flaggy-bird)
- [Dialtone](#dialtone)
- [TL;DR](#tldr)
- [Misc](#misc)
- [Doomed to Repeat It](#doomed-to-repeat-it)
- [bob needs a file](#bob-needs-a-file)
- [Hardware](#hardware)
- [flagrom](#flagrom)
- [TL;DR](#tldr-1)
- [Remote Control](#remote-control)
- [TL;DR](#tldr-2)
- [minetest](#minetest)
- [TL;DR](#tldr-3)
- [Web](#web)
- [BNV](#bnv)
- [gLotto](#glotto)
- [TL;DR](#tldr-4)
- [Pwn](#pwn)
- [MicroServiceDaemonOS](#micr
Bugzilla
CVE-2026-0964 libssh: Improper sanitation of paths received from SCP servers
bugzilla·2026-02-04·CVSS 5.9
CVE-2026-0964 [MEDIUM] CVE-2026-0964 libssh: Improper sanitation of paths received from SCP servers
CVE-2026-0964 libssh: Improper sanitation of paths received from SCP servers
A malicious SCP server can send unexpected paths that could make the
client application override local files outside of working directory.
This could be misused to create malicious executable or configuration
files and make the user execute them under specific consequences.
This is the same issue as in OpenSSH, tracked as CVE-2019-6111.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2026:18160 https://access.redhat.com/errata/RHSA-2026:18160
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2026:18683 https://access.redhat.com/errata/RHSA-2026:18683
Bugzilla
CVE-2019-6111 openssh: Improper validation of object names allows malicious server to overwrite files via scp client [fedora-all]
bugzilla·2019-01-15·CVSS 5.9
CVE-2019-6111 [MEDIUM] CVE-2019-6111 openssh: Improper validation of object names allows malicious server to overwrite files via scp client [fedora-all]
CVE-2019-6111 openssh: Improper validation of object names allows malicious server to overwrite files via scp client [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Bugzilla
CVE-2019-6111 openssh: Improper validation of object names allows malicious server to overwrite files via scp client
bugzilla·2019-01-15·CVSS 5.9
CVE-2019-6111 [MEDIUM] CVE-2019-6111 openssh: Improper validation of object names allows malicious server to overwrite files via scp client
CVE-2019-6111 openssh: Improper validation of object names allows malicious server to overwrite files via scp client
OpenSSH has a vulnerability in the scp client utility. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, scp client only perform cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example overwrite .ssh/authorized_keys).
External Reference:
https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
Proposed Patch:
https://sintonen.fi/advisories/s
Wiz
CVE-2026-0964 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-0964 [MEDIUM] CVE-2026-0964 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0964 :
Linux Debian vulnerability analysis and mitigation
A malicious SCP server can send unexpected paths that could make the
client application override local files outside of working directory.
This could be misused to create malicious executable or configuration
files and make the user execute them under specific consequences.
This is the same issue as in OpenSSH, tracked as CVE-2019-6111.
Source : NVD
## 5
Score
Published March 26, 2026
Severity MEDIUM
CNA Score 5.0
Affected Technologies
Linux Debian
Linux Ubuntu
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 10
Exploitation Probability (EPSS) N/A
Affected packages and libraries
libssh4
libssh4-32bit
Sources
N
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.htmlhttp://www.openwall.com/lists/oss-security/2019/04/18/1http://www.openwall.com/lists/oss-security/2022/08/02/1http://www.securityfocus.com/bid/106741https://access.redhat.com/errata/RHSA-2019:3702https://bugzilla.redhat.com/show_bug.cgi?id=1677794https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttps://cvsweb.openbsd.org/src/usr.bin/ssh/scp.chttps://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23%40%3Cdev.mina.apache.org%3Ehttps://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b%40%3Cdev.mina.apache.org%3Ehttps://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a%40%3Cdev.mina.apache.org%3Ehttps://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f%40%3Cdev.mina.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2019/03/msg00030.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/https://security.gentoo.org/glsa/201903-16https://security.netapp.com/advisory/ntap-20190213-0001/https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txthttps://usn.ubuntu.com/3885-1/https://usn.ubuntu.com/3885-2/https://www.debian.org/security/2019/dsa-4387https://www.exploit-db.com/exploits/46193/https://www.freebsd.org/security/advisories/FreeBSD-EN-19:10.scp.aschttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.htmlhttp://www.openwall.com/lists/oss-security/2019/04/18/1http://www.openwall.com/lists/oss-security/2022/08/02/1http://www.securityfocus.com/bid/106741https://access.redhat.com/errata/RHSA-2019:3702https://bugzilla.redhat.com/show_bug.cgi?id=1677794https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttps://cvsweb.openbsd.org/src/usr.bin/ssh/scp.chttps://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23%40%3Cdev.mina.apache.org%3Ehttps://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b%40%3Cdev.mina.apache.org%3Ehttps://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a%40%3Cdev.mina.apache.org%3Ehttps://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f%40%3Cdev.mina.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2019/03/msg00030.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/https://security.gentoo.org/glsa/201903-16https://security.netapp.com/advisory/ntap-20190213-0001/https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txthttps://usn.ubuntu.com/3885-1/https://usn.ubuntu.com/3885-2/https://www.debian.org/security/2019/dsa-4387https://www.exploit-db.com/exploits/46193/https://www.freebsd.org/security/advisories/FreeBSD-EN-19:10.scp.aschttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
2019-01-31
Published
Exploited in the wild