VYPR
← All advisories
Unrated severityOSV Advisory· Published Jan 31, 2019· Updated Dec 18, 2025

CVE-2019-6110

CVE-2019-6110

Description

OpenSSH 7.9 scp client displays arbitrary stderr from server, allowing ANSI control codes to hide file transfers.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

OpenSSH 7.9 scp client displays arbitrary stderr from server, allowing ANSI control codes to hide file transfers.

Vulnerability

In OpenSSH 7.9, the scp client accepts and displays arbitrary stderr output from the server without sanitization. This allows a malicious server or Man-in-the-Middle attacker to inject ANSI control codes that manipulate the terminal output, effectively hiding additional file transfers from the user [1][2]. The vulnerability stems from the client's failure to filter or escape control sequences in server-provided stderr messages.

Exploitation

An attacker must control the SSH server or be in a position to perform a Man-in-the-Middle attack (requiring the victim to accept a wrong host fingerprint) [1]. During an scp file retrieval, the attacker sends ANSI escape sequences via stderr to overwrite or clear lines of output, concealing the transfer of extra files (e.g., .bash_aliases) [2]. The victim sees only the expected file transfer progress, while the malicious file is silently written to the target directory.

Impact

By hiding the transfer of arbitrary files, the attacker can plant malicious startup scripts (e.g., .bash_aliases) in the victim's home directory. When the victim opens a new shell, the script executes, leading to arbitrary code execution with the victim's privileges [1]. This output manipulation vulnerability (CVE-2019-6110) is often combined with directory traversal or object validation flaws (CVE-2019-6111) to achieve full compromise [2].

Mitigation

OpenSSH 7.9p1 (and later) includes a fix for this issue; Gentoo recommends upgrading to >=net-misc/openssh-7.9_p1-r4 [3]. Users unable to upgrade should avoid using scp and instead use sftp or rsync for file transfers, as those protocols do not rely on the same stderr handling [1]. No workaround exists for the vulnerable scp client itself.

References
  1. https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
  2. OffSec’s Exploit Database Archive
  3. Multiple vulnerabilities (GLSA 201903-16) — Gentoo security

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

39

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"The scp client accepts and displays arbitrary stderr output from the server without sanitization, allowing ANSI control sequences to manipulate the terminal display."

Attack vector

A malicious scp server (or a Man-in-the-Middle attacker who tricks the victim into accepting a wrong host fingerprint) sends crafted ANSI control sequences over the stderr channel during an scp file transfer [ref_id=1]. The OpenSSH scp client blindly displays this stderr output to the user, allowing the attacker to hide the transfer of additional files (such as .bash_aliases) by overwriting or clearing portions of the terminal display. The victim sees only the expected file transfer progress and does not notice the extra files being written to the target directory.

Affected code

The advisory [ref_id=1] identifies the scp client in OpenSSH 7.9 as the vulnerable component. The flaw is in the client's handling of stderr output from the remote scp server — the client accepts and displays arbitrary stderr data without sanitization.

What the fix does

The advisory [ref_id=1] recommends applying the OpenSSH patch at https://anongit.mindrot.org/openssh.git/commit/?id=8976f1c4b2721c26e878151f52bdf346dfe2d54c (which addresses CVE-2019-6109, a related output-spoofing issue) and/or the unofficial hardening patch at https://sintonen.fi/advisories/scp-name-validator.patch. The advisory also suggests switching to sftp as a more robust alternative. No patch specific to CVE-2019-6110 alone is listed; the fix for stderr spoofing is expected to sanitize or filter ANSI control sequences from server-supplied stderr output before displaying it to the user.

Preconditions

  • networkVictim initiates an scp file transfer from a malicious server (or a MitM attacker who intercepts the connection and the victim accepts the wrong host fingerprint)
  • inputThe attacker-controlled server sends ANSI control sequences via the stderr channel

Reproduction

The advisory [ref_id=1] states that a proof-of-concept malicious scp server will be released at a later date and does not include reproduction steps. However, a public PoC is available at https://www.exploit-db.com/exploits/46193/. That exploit demonstrates a malicious scp server that sends ANSI escape sequences over stderr to hide the transfer of extra files (e.g., .bash_aliases) while the victim runs `scp user@remote:readme.txt .`.

Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.