CVE-2018-20685

Vulnerability

In OpenSSH 7.9, the scp client (scp.c) fails to properly validate directory names received from the remote server. Specifically, the sink() function does not reject empty filenames ("") or a single dot (".") as directory names. When the server sends a directory transfer command with an empty or dot name, the client applies the specified permissions (e.g., D0777 0 \n) to the target directory on the client side. This affects OpenSSH versions up to and including 7.9; the issue was introduced in the original rcp-based implementation. [2][4]

Exploitation

An attacker controlling an SSH server (or performing a Man-in-the-Middle attack with accepted fingerprint) can send a crafted SCP protocol response. When the victim uses scp to copy files from the malicious server, the server sends a directory directive with an empty or dot filename. The client, without proper validation, applies the permissions from that directive to the target directory (e.g., the current directory). No additional authentication or user interaction beyond the initial scp command is required. [2]

Impact

Successful exploitation allows the attacker to arbitrarily change the permissions of the target directory on the client side. This could lead to privilege escalation or unauthorized access if the directory permissions are weakened (e.g., made world-writable). The vulnerability does not directly allow file content modification or remote code execution, but combined with other flaws (like CVE-2019-6111) it can be part of a larger attack chain. [2][3]

Mitigation

The fix was committed to OpenSSH portable on 2018-11-16 (commit 6010c0303a422a9c5fa8860c061bf7105eb7f8b2) and released in OpenSSH 8.0. Red Hat Enterprise Linux 8 shipped openssh-8.0p1-3.el8 [1]. Ubuntu released updates in USN-3885-1 on 2019-02-07 [3]. Users should upgrade to OpenSSH 8.0 or later. As a workaround, avoid using scp with untrusted servers; use sftp or rsync instead. [2][4]