Security restrictions bypass in WinSCP - CVE-2019-6111

Vulnerability identifier: #VU16988

CSH Severity: Low

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-6111

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to missing received object name validation by the scp client. A malicious SCP server can overwrite arbitrary files in the SCP client target directory. If a recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example overwrite .ssh/authorized_keys).

WinSCP
Arch Linux
Gentoo Linux
Amazon Linux AMI
Anolis OS
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
openssh (Ubuntu package)
openssh (Debian package)
openssh (Alpine package)
pam_ssh_agent_auth
openssh
openssh-askpass
openssh-cavs
openssh-clients
openssh-keycat
openssh-ldap
openssh-server
Security Event Manager (SEM)
Dropbear
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
EMC Isilon OneFS

Update to version 5.14.

WinSCP - update to 5.14
openssh (Ubuntu package) - addressed in versions 1:6.6p1-2ubuntu2.12, 1:6.6p1-2ubuntu2.13, 1:7.2p2-4ubuntu2.7, 1:7.2p2-4ubuntu2.8, 1:7.6p1-4ubuntu0.2, 1:7.6p1-4ubuntu0.3, 1:7.7p1-4ubuntu0.2, 1:7.7p1-4ubuntu0.3
Security Event Manager (SEM) - addressed in versions 2021.4, 2024.2
openssh (Debian package) - update to 1:7.4p1-10+deb9u5
openssh (Alpine package) - update to 7.5_p1-r4
Dropbear - update to 2025.89
pam_ssh_agent_auth - update to 0.10.3-7.13.0.1
Dell EMC Unity Operating Environment (OE) - update to 5.0.0.0.5.116
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.0.0.5.116
openssh - update to 8.0p1-1.fc30
openssh - update to 8.0p1-13.0.1
openssh-askpass - update to 8.0p1-13.0.1
openssh-cavs - update to 8.0p1-13.0.1
openssh-clients - update to 8.0p1-13.0.1
openssh-keycat - update to 8.0p1-13.0.1
openssh-ldap - update to 8.0p1-13.0.1
openssh-server - update to 8.0p1-13.0.1
EMC Isilon OneFS - update to 8.2.1

• Exploit #6031 - OpenSSH SCP Client - Write Arbitrary Files (June 17, 2021)
• Exploit #6041 - SCP Client - Multiple Vulnerabilities (SSHtranger Things) (June 17, 2021)
• Exploit #3574 - SNP (CVE-2019-6111 vulnerability exploitation) (July 22, 2020)
• Exploit #2650 - SNP (CVE-2019-6111 vulnerability exploitation) (May 12, 2020)

• https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt

• Multiple vulnerabilities in SCP implementation in WinSCP
• OpenSUSE Linux update for openssh
• OpenSUSE Linux update for openssh
• Debian update for openssh
• Ubuntu update for OpenSSH
• Ubuntu update for OpenSSH
• OpenSUSE Linux update for openssh
• Arch Linux update for openssh
• OpenSUSE Linux update for openssh
• Gentoo update for OpenSSH
• Amazon Linux AMI update for openssh
• Red Hat update for openssh
• Security restrictions bypass in openssh (Alpine package)
• Security restrictions bypass in Dell EMC Isilon OneFS
• Multiple vulnerabilities in Dell EMC Unity Family
• SolarWinds Security Event Manager (SEM) update for third-party components
• SolarWinds Security Event Manager (SEM) update for third-party components
• Anolis OS update for openssh
• Fedora 30 update for openssh
• Security restrictions bypass in Dropbear SSH client