bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

Security hole in SCP allows files to be swapped

Summary

In January 2019 Harry Sintonen of F-Secure found five holes in the SCP implementations of OpenSSH, PuTTY and WinSCP. SCP does not check whether received files correspond to the requested ones, so a malicious server can swap files or place additional ones unnoticed. This could be used, for example, to replace .bashrc and execute malicious code the next time a program is called.

Ideas

  • The client trusted the server with file names and the file list.
  • Additionally transferred files could be hidden in the output.
  • The permissions of the target folder could also be changed.
  • The holes were initially not closed in the stable versions.

Insights

  • An old protocol without checking responses turns the server into an attacker.
  • Copy tools write foreign file names and need the same care as extractors.

Facts

  • The holes carry identifiers including CVE-2018-20685, CVE-2019-6109, CVE-2019-6110 and CVE-2019-6111.
  • scp in OpenSSH, pscp in PuTTY and WinSCP were affected.
  • Sintonen had already reported the holes in August 2018; OpenSSH 7.9 was affected.

References

Critique

  • The report describes the risk but names no workaround such as switching to SFTP.

Remarks

  • Since OpenSSH 9.0, scp uses the SFTP protocol by default instead of the old SCP protocol.

Recommendations

  • Use sftp or rsync over SSH instead of the classic SCP protocol.
  • Only copy from untrusted servers into empty, specially created directories.

Read the original article

Search the Web Archive

g · 2026

Broadcom hole lets attackers knock out entire Wi-Fi networks

In January 2026 researchers from Black Duck found a hole in Broadcom Wi-Fi chipsets through which an attacker within radio range can knock out a 5 GHz network with a single packet, without logging in and regardless of WPA2 or WPA3. All clients lose their connection until the router is restarted, and the attack can be repeated immediately. Testing was done on an Asus RT-BE86U; Broadcom had already patched, but how far manufacturers had passed this on remained unclear.

g · 2025

17,000 Linux servers vulnerable to critical rsync hole

In January 2025 six holes in rsync became known, including the critical CVE-2024-12084, which in combination allows servers with only anonymous read access to be taken over. According to Shadowserver, 17,475 freely reachable rsync servers worldwide were vulnerable on 16 January, with Germany in fifth place with 956. All versions up to 3.3.0 were affected; the fixes came in 3.4.0 and 3.4.1.

g · 2023

Security hole in SugarCRM servers actively exploited

In early 2023 attackers exploited a critical hole in SugarCRM (CVE-2023-22952) to take over servers and install malware. Authentication could be bypassed via the path /index.php/, after which a POST request uploaded a PNG file containing PHP code that was executed when called up later. By 11 January Censys found 354 compromised servers, just under twelve percent of all 3,059 reachable instances.