Bug 1506630 (CVE-2017-15906)

Summary: CVE-2017-15906 openssh: Improper write operations in readonly mode allow for zero-length file creation
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: dwalsh, ebrizuel, huzaifas, jfch, jjelen, kbost, lkundrak, mattias.ellert, plautrba, security-response-team, slawomir, tmraz, yjog, yozone
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: openssh 7.6 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 03:30:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1506631, 1517226    
Bug Blocks: 1498774, 1506633    

Description Andrej Nemec 2017-10-26 13:16:17 UTC 
The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.

Upstream patch:

https://github.com/openbsd/src/commit/a6981567e8e215acc1ef690c8dbb30f2d9b00a19

References:

https://www.openssh.com/txt/release-7.6
Comment 1 Andrej Nemec 2017-10-26 13:16:50 UTC 
Created openssh tracking bugs for this issue:

Affects: fedora-all [bug 1506631]
Comment 2 Huzaifa S. Sidhpurwala 2017-11-01 05:45:56 UTC 
Analysis:

It seems the maximum impact of this flaw is that the attacker can create an extremely large number of zero length files to fill up a harddisk on a remote server which the attacker has read-only access to.
Comment 10 errata-xmlrpc 2018-04-10 08:37:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:0980 https://access.redhat.com/errata/RHSA-2018:0980