Vulnerability CVE-2019-6109: Information

Description

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.

Severity: MEDIUM (6.8) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2019-6109
Published: Jan. 31, 2019
Modified: Nov. 7, 2023
Error type identifier: CWE-116

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
opensshsisyphus7.9p1-alt19.6p1-alt1ALT-PU-2018-2598-1215513Fixed
opensshp107.9p1-alt4.p10.17.9p1-alt4.p10.6ALT-PU-2022-1557-1297014Fixed
opensshp10_e2k7.9p1-alt4.p10.17.9p1-alt4.p10.6ALT-PU-2022-4375-1-Fixed
opensshp97.9p1-alt17.9p1-alt1ALT-PU-2018-2598-1215513Fixed
opensshc10f17.9p1-alt4.p10.17.9p1-alt4.p10.6ALT-PU-2022-1557-1297014Fixed
opensshc9f27.9p1-alt4.p10.17.9p1-alt4.p10.6ALT-PU-2022-1569-1297070Fixed
openssh-gostcryptop107.9p1-alt4.gost.p10.17.9p1-alt4.gost.p10.3ALT-PU-2024-3921-3342647Fixed
openssh-gostcryptoc10f17.9p1-alt4.gost.p10.17.9p1-alt4.gost.p10.3ALT-PU-2024-4467-2342830Fixed
openssh-gostcryptoc9f27.9p1-alt4.gost.p10.17.9p1-alt4.gost.p10.3ALT-PU-2024-4077-2342832Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
  • Third Party Advisory
https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c
  • Release Notes
  • Vendor Advisory
https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c
  • Release Notes
  • Vendor Advisory
USN-3885-1
  • Third Party Advisory
DSA-4387
  • Third Party Advisory
https://security.netapp.com/advisory/ntap-20190213-0001/
  • Third Party Advisory
GLSA-201903-16
  • Third Party Advisory
[debian-lts-announce] 20190325 [SECURITY] [DLA 1728-1] openssh security update
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2019:1602
  • Broken Link
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
  • Patch
  • Third Party Advisory
RHSA-2019:3702
  • Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
  • Patch
  • Third Party Advisory
FEDORA-2019-0f4190cdb0

      1. Configuration 1

        cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
        End including
        7.9
        cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:*
        End including
        5.13

        Configuration 2

        cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
        cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
        cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
        cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

        Configuration 3

        cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
        cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

        Configuration 4

        cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
        cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*
        cpe:2.3:a:netapp:ontap_select_deploy:-:*:*:*:*:*:*:*

        Configuration 5

        cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

        Configuration 6

        cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
        cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
        cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
        cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
        cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
        cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
        cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
        cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
        cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
        cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*
        cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*

        Configuration 7

        cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:*
        Running on/with:
        cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:*

        Configuration 8

        cpe:2.3:o:siemens:scalance_x204rna_eec_firmware:*:*:*:*:*:*:*:*
        Running on/with:
        cpe:2.3:h:siemens:scalance_x204rna_eec:-:*:*:*:*:*:*:*

        Configuration 9

        cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:*
        Running on/with:
        cpe:2.3:h:fujitsu:m10-1:-:*:*:*:*:*:*:*

        Configuration 10

        cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:*
        Running on/with:
        cpe:2.3:h:fujitsu:m10-4:-:*:*:*:*:*:*:*

        Configuration 11

        cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:*
        Running on/with:
        cpe:2.3:h:fujitsu:m10-4s:-:*:*:*:*:*:*:*

        Configuration 12

        cpe:2.3:o:fujitsu:m12-1_firmware:*:*:*:*:*:*:*:*
        Running on/with:
        cpe:2.3:h:fujitsu:m12-1:-:*:*:*:*:*:*:*

        Configuration 13

        cpe:2.3:o:fujitsu:m12-2_firmware:*:*:*:*:*:*:*:*
        Running on/with:
        cpe:2.3:h:fujitsu:m12-2:-:*:*:*:*:*:*:*

        Configuration 14

        cpe:2.3:o:fujitsu:m12-2s_firmware:*:*:*:*:*:*:*:*
        Running on/with:
        cpe:2.3:h:fujitsu:m12-2s:-:*:*:*:*:*:*:*

        Configuration 15

        cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:*
        Running on/with:
        cpe:2.3:h:fujitsu:m10-1:-:*:*:*:*:*:*:*

        Configuration 16

        cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:*
        Running on/with:
        cpe:2.3:h:fujitsu:m10-4:-:*:*:*:*:*:*:*

        Configuration 17

        cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:*
        Running on/with:
        cpe:2.3:h:fujitsu:m10-4s:-:*:*:*:*:*:*:*

        Configuration 18

        cpe:2.3:o:fujitsu:m12-1_firmware:*:*:*:*:*:*:*:*
        Running on/with:
        cpe:2.3:h:fujitsu:m12-1:-:*:*:*:*:*:*:*

        Configuration 19

        cpe:2.3:o:fujitsu:m12-2_firmware:*:*:*:*:*:*:*:*
        Running on/with:
        cpe:2.3:h:fujitsu:m12-2:-:*:*:*:*:*:*:*

        Configuration 20

        cpe:2.3:o:fujitsu:m12-2s_firmware:*:*:*:*:*:*:*:*
        Running on/with:
        cpe:2.3:h:fujitsu:m12-2s:-:*:*:*:*:*:*:*
    VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
    Version: v24.5.1
    Back to top