Vulnerability · Published Jun 1, 2020 · Assigned by mitre
CVE-2020-12062
High 7.5
In plain English
A high-severity security flaw in the openssh package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | openssh | 1:8.3p1-1 | DEBIAN-CVE-2020-12062 |
| Debian:13 | openssh | 1:8.3p1-1 | DEBIAN-CVE-2020-12062 |
| Debian:14 | openssh | 1:8.3p1-1 | DEBIAN-CVE-2020-12062 |
Affected products (as reported)
References
- https://www.openwall.com/lists/oss-security/2020/05/27/1 x_refsource_MISC
- https://www.openssh.com/txt/release-8.3 x_refsource_MISC
- https://github.com/openssh/openssh-portable/commit/955854cafca88e0cdcd3d09ca1ad4ada465364a1 x_refsource_MISC
- https://github.com/openssh/openssh-portable/commit/aad87b88fc2536b1ea023213729aaf4eaabe1894 x_refsource_MISC
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html