Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-6110

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.

Published

2019-01-31T18:29:00.807

Last Modified

2024-11-21T04:45:57.737

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.8 (MEDIUM)

CVSSv2 Vector

AV:N/AC:H/Au:N/C:P/I:P/A:N

Access Vector: NETWORK
Access Complexity: HIGH
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

4.9

Impact Score

4.9

Weaknesses

Type: Primary
CWE-838

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	openbsd	openssh	≤ 7.9	Yes
Application	winscp	winscp	≤ 5.13	Yes
Application	netapp	element_software	-	Yes
Application	netapp	ontap_select_deploy	-	Yes
Application	netapp	storage_automation_store	-	Yes
Operating System	siemens	scalance_x204rna_firmware	< 3.2.7	Yes
Hardware	siemens	scalance_x204rna	-	No
Operating System	siemens	scalance_x204rna_eec_firmware	< 3.2.7	Yes
Hardware	siemens	scalance_x204rna_eec	-	No

References

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf Patch, Third Party Advisory ([email protected])
https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c Release Notes ([email protected])
https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c Release Notes ([email protected])
https://security.gentoo.org/glsa/201903-16 Third Party Advisory ([email protected])
https://security.netapp.com/advisory/ntap-20190213-0001/ Third Party Advisory ([email protected])
https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt Third Party Advisory ([email protected])
https://www.exploit-db.com/exploits/46193/ Exploit, Third Party Advisory, VDB Entry ([email protected])
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c Release Notes (af854a3a-2127-422b-91ae-364da2661108)
https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c Release Notes (af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/201903-16 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20190213-0001/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.exploit-db.com/exploits/46193/ Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)