What’s Vulnerable › Vulnerabilities

CVE-2019-6111

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 58.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-01-31 · updated 2026-10-14
• Weakness: CWE-22

Description

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).

Affected products

• Apache Software Foundation Apache MINA SSHD: 2.2.0
• Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 18.10
• Debian Linux: 8.0, 9.0
• Fedoraproject Fedora: 30
• FreeBSD: before 12.0; 12.0, 12.0-p1, 12.0-p2, 12.0-p3 — fixed in 12.0
• Fujitsu M10-1 Firmware: before xcp2361; before xcp3070 — fixed in xcp2361, xcp3070
• Fujitsu M10-4 Firmware: before xcp2361; before xcp3070 — fixed in xcp2361, xcp3070
• Fujitsu M10-4S Firmware: before xcp2361; before xcp3070 — fixed in xcp2361, xcp3070
• Fujitsu M12-1 Firmware: before xcp2361; before xcp3070 — fixed in xcp2361, xcp3070
• Fujitsu M12-2 Firmware: before xcp2361; before xcp3070 — fixed in xcp2361, xcp3070
• Fujitsu M12-2S Firmware: before xcp2361; before xcp3070 — fixed in xcp2361, xcp3070
• OpenSSH: through 7.9
• Red Hat Enterprise Linux: 7.0, 8.0
• RedHat Enterprise Linux Eus: 8.1, 8.2, 8.4, 8.6
• RedHat Enterprise Linux Server Aus: 8.2, 8.4, 8.6
• RedHat Enterprise Linux Server Tus: 8.2, 8.4, 8.6
• Siemens Scalance X204Rna Eec Firmware: before 3.2.7 — fixed in 3.2.7
• Siemens Scalance X204Rna Firmware: before 3.2.7 — fixed in 3.2.7
• Winscp: through 5.1.3

How to fix

Upgrade to a fixed version: FreeBSD 12.0; Fujitsu M10-1 Firmware xcp2361, xcp3070; Fujitsu M10-4 Firmware xcp2361, xcp3070; Fujitsu M10-4S Firmware xcp2361, xcp3070; Fujitsu M12-1 Firmware xcp2361, xcp3070; Fujitsu M12-2 Firmware xcp2361, xcp3070; Fujitsu M12-2S Firmware xcp2361, xcp3070; Siemens Scalance X204Rna Eec Firmware 3.2.7; Siemens Scalance X204Rna Firmware 3.2.7. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html
• http://www.openwall.com/lists/oss-security/2019/04/18/1
• http://www.openwall.com/lists/oss-security/2022/08/02/1
• http://www.securityfocus.com/bid/106741
• https://access.redhat.com/errata/RHSA-2019:3702
• https://bugzilla.redhat.com/show_bug.cgi?id=1677794
• https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
• https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c
• https://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23%40%3Cdev.mina.apache.org%3E
• https://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b%40%3Cdev.mina.apache.org%3E
• https://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a%40%3Cdev.mina.apache.org%3E
• https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f%40%3Cdev.mina.apache.org%3E

Get alerted when CVE-2019-6111 or the next vulnerability affects your stack