VDB
GCVE-110-MAGEIA-2021-525
GCVE-110-MAGEIA-2021-525
Advisory Published
In NetKit through 0.17, rcp.c in the rcp client allows remote rsh servers
to bypass intended access restrictions via the filename of . or an empty
filename. The impact is modifying the permissions of the target directory
on the client side. This is similar to CVE-2018-20685. (CVE-2019-7282)
An issue was discovered in rcp in NetKit through 0.17. For an rcp
operation, the server chooses which files/directories are sent to the
client. However, the rcp client only performs cursory validation of the
object name returned. A malicious rsh server (or Man-in-The-Middle
attacker) can overwrite arbitrary files in a directory on the rcp client
machine. This is similar to CVE-2019-6111. (CVE-2019-7283).
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Mageia | rsh | 0 (affected), 0.17-36.1.mga8 (unaffected) | — |
Aliases
References
Browse GCVE Records
74,299 records in the GCVE database · Updated July 22, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.