Security restrictions bypass in OpenSSH - CVE-2018-20685

Vulnerability identifier: #VU16946

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-20685

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to improper validation of filenames by the scp.c source code file in the SCP client . A remote unauthenticated attacker can trick the victim into accessing a file with the filename of . or an empty filename from an attacker-controlled Secure Shell (SSH) server to bypass access restrictions on the system, which could be used to conduct further attacks.

OpenSSH
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Anolis OS
Opensuse
Fedora
WinSCP
openssh (Ubuntu package)
openssh (Debian package)
openssh (Alpine package)
dropbear (Alpine package)
pam_ssh_agent_auth
openssh
openssh-askpass
openssh-cavs
openssh-clients
openssh-keycat
openssh-ldap
openssh-server
Security Event Manager (SEM)
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)

Install update from vendor's website.

WinSCP - update to 5.14
openssh (Ubuntu package) - addressed in versions 1:6.6p1-2ubuntu2.12, 1:7.2p2-4ubuntu2.7, 1:7.6p1-4ubuntu0.2, 1:7.7p1-4ubuntu0.2
Security Event Manager (SEM) - addressed in versions 2021.4, 2024.2
openssh (Debian package) - update to 1:7.4p1-10+deb9u5
openssh (Alpine package) - update to 7.5_p1-r4
dropbear (Alpine package) - addressed in versions 2018.76-r3, 2019.78-r1
pam_ssh_agent_auth - update to 0.10.3-7.13.0.1
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.0.0.5.116
Dell EMC Unity Operating Environment (OE) - update to 5.0.0.0.5.116
openssh - addressed in versions 7.8p1-4.fc28, 7.9p1-3.fc29
openssh - update to 8.0p1-13.0.1
openssh-askpass - update to 8.0p1-13.0.1
openssh-cavs - update to 8.0p1-13.0.1
openssh-clients - update to 8.0p1-13.0.1
openssh-keycat - update to 8.0p1-13.0.1
openssh-ldap - update to 8.0p1-13.0.1
openssh-server - update to 8.0p1-13.0.1

• https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.197&r2=1.198&f=h
• https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2

• Multiple vulnerabilities in SCP implementation in WinSCP
• OpenSUSE Linux update for openssh
• OpenSUSE Linux update for openssh
• Debian update for openssh
• Ubuntu update for OpenSSH
• Gentoo update for OpenSSH
• Amazon Linux AMI update for openssh
• Red Hat update for openssh
• Gentoo update for Dropbear
• Security restrictions bypass in dropbear (Alpine package)
• Security restrictions bypass in openssh (Alpine package)
• Multiple vulnerabilities in Dell EMC Unity Family
• SolarWinds Security Event Manager (SEM) update for third-party components
• SolarWinds Security Event Manager (SEM) update for third-party components
• Anolis OS update for openssh
• Fedora 29 update for openssh
• Fedora 28 update for openssh