National Cyber Awareness System

Vulnerability Summary for CVE-2004-0175

Overview

Directory traversal vulnerability in scp for OpenSSH before 3.4p1 allows remote malicious servers to overwrite arbitrary files. NOTE: this may be a rediscovery of CVE-2000-0992.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statements (disclaimer)

Official Statement from Red Hat (03/14/2007)

Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 9986

Type: Advisory; Patch Information

Hyperlink:http://www.securityfocus.com/bid/9986

External Source: CONFIRM

Name: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=120147

Hyperlink:https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=120147

External Source: XF

Name: openssh-scp-file-overwrite(16323)

Hyperlink:http://xforce.iss.net/xforce/xfdb/16323

External Source: REDHAT

Name: RHSA-2005:567

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-567.html

External Source: REDHAT

Name: RHSA-2005:562

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-562.html

External Source: REDHAT

Name: RHSA-2005:495

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-495.html

External Source: REDHAT

Name: RHSA-2005:481

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-481.html

External Source: REDHAT

Name: RHSA-2005:165

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-165.html

External Source: REDHAT

Name: RHSA-2005:106

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-106.html

External Source: REDHAT

Name: RHSA-2005:074

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-074.html

External Source: OSVDB

Name: 9550

Hyperlink:http://www.osvdb.org/9550

External Source: SUSE

Name: SuSE-SA:2004:009

Hyperlink:http://www.novell.com/linux/security/advisories/2004_09_kernel.html

External Source: MANDRIVA

Name: MDVSA-2008:191

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:191

External Source: MANDRIVA

Name: MDKSA-2005:100

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2005:100

External Source: CONFIRM

Name: http://www.juniper.net/support/security/alerts/adv59739.txt

Hyperlink:http://www.juniper.net/support/security/alerts/adv59739.txt

External Source: CIAC

Name: O-212

Hyperlink:http://www.ciac.org/ciac/bulletins/o-212.shtml

External Source: SECUNIA

Name: 19243

Hyperlink:http://secunia.com/advisories/19243

External Source: SECUNIA

Name: 17135

Hyperlink:http://secunia.com/advisories/17135

External Source: OVAL

Name: oval:org.mitre.oval:def:10184

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10184

External Source: CONECTIVA

Name: CLSA-2004:831

Hyperlink:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000831

External Source: SCO

Name: SCOSA-2006.11

Hyperlink:ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.11/SCOSA-2006.11.txt

References to Check Content

Identifier:oval:org.mitre.oval:def:10184

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10184