Vulnetix
Try Vulnetix Request Demo
CVE-2020-12062 PUBLISHED

The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances.

EPSS 0.83% · 74.4th percentile

Risk Scores

EPSS Score
0.83%
74.4th percentile

Affected Products

VendorProductVersions
Ubuntu:20.04:LTSopenssh-ssh11:7.5p1-11build1, 0
Ubuntu:Pro:14.04:LTSopenssh1:6.2p2-6ubuntu1, 1:6.4p1-1, 1:6.4p1-2
Ubuntu:20.04:LTSopenssh1:8.2p1-4ubuntu0.3, 0, 1:8.0p1-6build1
Ubuntu:18.04:LTSopenssh-ssh11:7.5p1-10, 1:7.5p1-9build1, 1:7.5p1-9
Ubuntu:Pro:16.04:LTSopenssh1:7.2p2-4ubuntu2.10+esm2, 1:7.2p2-4ubuntu2.10+esm3, 1:7.2p2-4ubuntu2.10+esm4
Ubuntu:Pro:18.04:LTSopenssh1:7.6p1-4ubuntu0.3, 1:7.6p1-4ubuntu0.5, 1:7.6p1-4ubuntu0.6

Timeline

References

Open in Interactive Console →