CVE-2019-7283

Vulnerability

An issue exists in rcp in NetKit through version 0.17. The server selects which files or directories to send to the client, but the client performs only cursory validation of the object names returned. This allows a malicious rsh server or a Man-in-the-Middle attacker to overwrite arbitrary files in the target directory on the rcp client machine. The vulnerability is similar to CVE-2019-6111, which affects scp clients derived from rcp. The affected versions are NetKit rcp up to and including 0.17 [1].

Exploitation

The attacker must control the rsh server or be able to perform a Man-in-the-Middle attack on the connection. In the MITM scenario, the victim must accept a wrong host fingerprint. The attacker then provides a crafted directory or file name during the rcp protocol exchange. For example, a malicious server could send a file named "D0777 0 .\n" or use a directory traversal name to overwrite files like .bash_aliases in the victim's home directory. The extra file transfer can be hidden by sending ANSI control sequences via stderr [1].

Impact

A successful attack allows the attacker to write arbitrary files to the rcp client's target directory, potentially achieving code execution if files such as shell aliases or configuration files are overwritten. The attacker can also modify target directory permissions. The impact is arbitrary file write with the privilege level of the client user, potentially leading to full compromise of the client system [1].

Mitigation

As of the advisory date (2019-01-31), no official patch for NetKit rcp has been released. Users are advised to avoid using rcp and instead use more secure alternatives such as scp with proper validation (if patched) or sftp. The vulnerability is not known to be on the CISA KEV list. Administrators should treat rcp as an insecure protocol and disable or firewall rsh/rcp services [1].