Security restrictions bypass in WinSCP - CVE-2019-6111

Vulnerability identifier: #VU16988

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear

CVE-ID: CVE-2019-6111

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Affected software:
WinSCP
Arch Linux
Gentoo Linux
Amazon Linux AMI
Anolis OS
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
openssh (Ubuntu package)
openssh (Debian package)
openssh (Alpine package)
pam_ssh_agent_auth
openssh
openssh-askpass
openssh-cavs
openssh-clients
openssh-keycat
openssh-ldap
openssh-server
Security Event Manager (SEM)
Dropbear
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
EMC Isilon OneFS

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to missing received object name validation by the scp client. A malicious SCP server can overwrite arbitrary files in the SCP client target directory. If a recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example overwrite .ssh/authorized_keys).

Update to version 5.14.

• https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt