Technical Description

OpenBSD has released security patches to address a vulnerability identified in OpenSSH. This flaw is due to an error in scp that does not properly validate filenames supplied from the command line before being passed to a "system()" function when performing a local-to-local copy, which could be exploited by malicious users to inject and execute shell commands with the privileges of the user running scp. For additional information, see : VUPEN/ADV-2006-0306

Affected Products

OpenBSD 3.8
OpenBSD 3.7

Solution

Patch for OpenBSD 3.8 :
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/005_ssh.patch
Patch for OpenBSD 3.7 :
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/011_ssh.patch

References

http://www.vupen.com/english/advisories/2006/0520
http://www.openbsd.org/errata.html#ssh
http://www.openbsd.org/errata37.html#ssh

ChangeLog

2006-02-12 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts with CVE, CWE, and CVSS when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.