Vulnerability identifier: #VU23508
Vulnerability risk: Medium
Exploitation vector: Network
Exploit availability: No
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to incorrect handling of the SCP command parameters when initiating the connection within the ssh_scp_new() function. A remote attacker can trick victim into using a specially crafted SCP command to connect to a remote SCP server and execute arbitrary commands on the target server with privileges of the current user.
Install updates from vendor's website.
Vulnerable software versions
libssh: 0.4.0 - 0.9.2
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?