CVE-2018-20685

Published: Jan 10, 2019Modified: Dec 17, 2025

5.3

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability: 1.6 / Impact: 3.6

Source: NVD

Description

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.

Affected (40)

Products: Openbsd: Openssh · Winscp: Winscp · Netapp: Cloud Backup, Element Software, Ontap Select Deploy, Steelstore Cloud Integrated Storage, Storage Automation Store · +6 more

Show all products

1 product

1 product

5 products

Steelstore Cloud Integrated Storage

Storage Automation Store

1 product

1 product

4 products

Enterprise Linux Server Aus

Enterprise Linux Server Tus

1 product

6 products

2 products

Scalance X204rna Firmware

Scalance X204rna Eec Firmware

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Openbsd Openssh	Up to 7.9
Winscp Winscp	Up to 5.13

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Netapp Cloud Backup	All versions
Netapp Element Software	All versions
Netapp Ontap Select Deploy	All versions
Netapp Steelstore Cloud Integrated Storage	All versions
Netapp Storage Automation Store	All versions

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 18.10

Configuration E

12 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux Eus	Version 8.1
Redhat Enterprise Linux Eus	Version 8.2
Redhat Enterprise Linux Eus	Version 8.4
Redhat Enterprise Linux Eus	Version 8.6
Redhat Enterprise Linux Server Aus	Version 8.2
Redhat Enterprise Linux Server Aus	Version 8.4
Redhat Enterprise Linux Server Aus	Version 8.6
Redhat Enterprise Linux Server Tus	Version 8.2
Redhat Enterprise Linux Server Tus	Version 8.4
Redhat Enterprise Linux Server Tus	Version 8.6

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Solaris	Version 10

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M10 1 Firmware	Before xcp2361

Configuration H

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M10 4 Firmware	Before xcp2361

Configuration I

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M10 4s Firmware	Before xcp2361

Configuration J

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M12 1 Firmware	Before xcp2361

Configuration K

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M12 2 Firmware	Before xcp2361

Configuration L

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M12 2s Firmware	Before xcp2361

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M10 1 Firmware	Before xcp3070

Running on/with	Platform Versions
Fujitsu M10 1	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M10 4 Firmware	Before xcp3070

Running on/with	Platform Versions
Fujitsu M10 4	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M10 4s Firmware	Before xcp3070

Running on/with	Platform Versions
Fujitsu M10 4s	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M12 1 Firmware	Before xcp3070

Running on/with	Platform Versions
Fujitsu M12 1	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M12 2 Firmware	Before xcp3070

Running on/with	Platform Versions
Fujitsu M12 2	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M12 2s Firmware	Before xcp3070

Running on/with	Platform Versions
Fujitsu M12 2s	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance X204rna Firmware	Before 3.2.7

Running on/with	Platform Versions
Siemens Scalance X204rna	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance X204rna Eec Firmware	Before 3.2.7

Running on/with	Platform Versions
Siemens Scalance X204rna Eec	All versions

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (28)

http://www.securityfocus.com/bid/106531

Source: cve@mitre.org

Broken Link

https://access.redhat.com/errata/RHSA-2019:3702

Source: cve@mitre.org

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Source: cve@mitre.org

PatchThird Party Advisory

https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.197&r2=1.198&f=h

Source: cve@mitre.org

Patch

https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2

Source: cve@mitre.org

Patch

https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/201903-16

Source: cve@mitre.org

Third Party Advisory

https://security.gentoo.org/glsa/202007-53

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20190215-0001/

Source: cve@mitre.org

Third Party Advisory

https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt

Source: cve@mitre.org

PatchThird Party Advisory

https://usn.ubuntu.com/3885-1/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2019/dsa-4387

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Source: cve@mitre.org

PatchThird Party Advisory

http://www.securityfocus.com/bid/106531