CVE-2019-6109

Vulnerability

The vulnerability resides in the refresh_progress_meter() function in progressmeter.c of OpenSSH version 7.9 (and possibly earlier versions). The function fails to sanitize or encode the progress display output when receiving file names or other data from an SCP server. This allows a malicious server (or a Man-in-the-Middle attacker) to inject ANSI escape sequences that manipulate the client's terminal output, effectively hiding additional file transfers. The flaw was publicly reported by Harry Sintonen as part of a set of SCP client vulnerabilities [2].

Exploitation

An attacker must control the SCP server that the victim connects to, or be able to perform a Man-in-the-Middle attack. In the MITM scenario, the victim must accept the attacker's host key fingerprint. The attacker sends a crafted file name containing ANSI control codes during the SCP transfer. The client's progress meter prints these codes to the terminal without escaping them, allowing the attacker to erase or overwrite lines in the terminal output. This hides the appearance of extra files (e.g., ~/.bash_aliases) being transferred and written to the target directory. An example attack sequence: victim uses scp user@remote:readme.txt . while the malicious server sends readme.txt plus an extra hidden .bash_aliases file, using ANSI sequences to remove the second file from the displayed output [2].

Impact

A successful attacker can write arbitrary files to the victim's SCP target directory (subject to the file name validation flaws described in CVE-2019-6111) while concealing those writes from the client's terminal output. The attacker can also change permissions of the target directory (CVE-2018-20685). In a typical scenario, the attacker drops a malicious .bash_aliases file into the victim's home directory, which executes arbitrary commands when the victim opens a new shell. This can lead to full compromise of the victim's local account [2].

Mitigation

The vulnerability is fixed in OpenSSH 8.0 [2]. Red Hat Enterprise Linux 8 ships openssh-8.0p1-3.el8 [1]. Ubuntu released updated packages as part of USN-3885-1 on 7 February 2019 [3]. Fedora advisories also provide updates [4]. Users unable to upgrade should avoid using scp from untrusted servers; alternative tools like rsync, sftp, or scp -O (if available) may reduce risk. There is no evidence that this CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.