Bug 1666119 (CVE-2019-6109) - CVE-2019-6109 openssh: Missing character encoding in progress display allows for spoofing of scp client output
Summary: CVE-2019-6109 openssh: Missing character encoding in progress display allows ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-6109
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1666121 1666576 1666577
Blocks: 1665788
TreeView+ depends on / blocked
 
Reported: 2019-01-15 00:26 UTC by Sam Fowler
Modified: 2019-11-06 00:51 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-11-06 00:51:45 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:3702 None None None 2019-11-05 22:06:27 UTC

Description Sam Fowler 2019-01-15 00:26:38 UTC
OpenSSH has a vulnerability in the scp client utility. Due to missing character encoding in the progress display, the object name can be used to manipulate the client output, for example to employ ANSI codes to hide additional files being transferred.


External Reference:

https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt


Proposed Patch:

https://sintonen.fi/advisories/scp-name-validator.patch

Comment 1 Sam Fowler 2019-01-15 00:27:09 UTC
Created openssh tracking bugs for this issue:

Affects: fedora-all [bug 1666121]

Comment 2 Jakub Jelen 2019-01-15 09:40:11 UTC
There was a patch sanitizing the encoding of the filenames in the progress meter, but the upstream bugzilla is down so I can not find it. I would rather see fixed it in this way, rather than with this patch, which is not accepted upstream and is very intrusive.

Comment 3 Huzaifa S. Sidhpurwala 2019-01-16 05:18:32 UTC
Analysis:

This is a flaw in the scp client (/usr/bin/scp) shipped as a part of openssh-clients package. The flaw essentially allows a malicious scp server to manipulate the output seen by the client (i.e. the progress display when the files are being transferred) by allowing the server to push ANSI characters to the client. Though this vulnerability has no impact on its on, it can be used with other flaws to hide additional files being transferred by the malicious client.

To trigger this flaw, the scp client needs to either connect to a malicious scp server or connect to a MITM scp server. Connecting to a MITM server will require the client to accept the new host key, which essentially implies that either the scp server (which the client previously connected to) has changed or there is a possible MITM attempt, both of which should be investigated by the system administrator before going ahead with the connection.

Also note that, since this is a flaw in the scp utility, the SSH client is not affected.

Comment 4 Huzaifa S. Sidhpurwala 2019-01-16 05:19:59 UTC
Statement:

This issue affects the scp client shipped with openssh. The SSH protocol or the SSH client is not affected. For more detailed analysis please refer to: https://bugzilla.redhat.com/show_bug.cgi?id=1666119#c3

Comment 6 Jakub Jelen 2019-01-17 16:21:39 UTC
For the record, exactly this issue was already reported three years ago, there were already attempts to solve it, but nothing was merged yet.

https://bugzilla.mindrot.org/show_bug.cgi?id=2434

Comment 7 kbresin 2019-03-25 19:53:12 UTC
Of note, as of 03/25 the severity of CVE-2019-6109 has been upgraded to medium.

https://nvd.nist.gov/vuln/detail/CVE-2019-6109

Comment 10 Huzaifa S. Sidhpurwala 2019-07-23 04:16:56 UTC
Mitigation:

This issue only affects the users of scp binary which is a part of openssh-clients package. Other usage of SSH protocol or other ssh clients is not affected. Administrators can uninstall openssh-clients for additional protection against accidental usage of this binary. Removing the openssh-clients package will make binaries like scp and ssh etc unavailable on that system.

Note: To exploit this flaw, the victim needs to connect to a malicious SSH server or MITM (Man-in-the-middle) the scp connection, both of which can be detected by the system administrator via a change in the host key of the SSH server. Further, if connections via scp are made to only trusted SSH servers, then those use-cases are not vulnerable to this security flaw.

Comment 11 errata-xmlrpc 2019-11-05 22:06:26 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:3702 https://access.redhat.com/errata/RHSA-2019:3702

Comment 12 Product Security DevOps Team 2019-11-06 00:51:45 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-6109


Note You need to log in before you can comment on or make changes to this bug.