National Vulnerability Database (NVD) National Vulnerability Database (CVE-2006-0225)

National Cyber Awareness System

Vulnerability Summary for CVE-2006-0225

Original release date:01/25/2006

Last revised:03/08/2011

Source: US-CERT/NIST

Overview

scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.

Impact

CVSS Severity (version 2.0 upgrade from v1.0):

CVSS v2 Base Score:4.6 (MEDIUM) (AV:L/AC:L/Au:N/C:P/I:P/A:P) (legend)

Impact Subscore: 6.4

Exploitability Subscore: 3.9

CVSS Version 2 Metrics:

Access Vector: Locally exploitable

Access Complexity: Low

Authentication: Not required to exploit

Impact Type:Provides user account access, Allows partial confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service

Vendor Statements (disclaimer)

Official Statement from Red Hat (09/09/2009)

This issue was addressed in Red Hat Enterprise Linux 2.1, 3 and 4: https://rhn.redhat.com/errata/CVE-2006-0225.html https://www.redhat.com/security/data/cve/CVE-2006-0225.html Issue was fixed upstream in version 4.3. The openssh packages in Red Hat Enterprise Linux 5 are based on the fixed upstream version and were not affected by this flaw.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA07-072A

Name: TA07-072A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA07-072A.html

External Source: SECUNIA

Name: 18595

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/18595

External Source: CONFIRM

Name: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=174026

Hyperlink:https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=174026

External Source: XF

Name: openssh-scp-command-execution(24305)

Hyperlink:http://xforce.iss.net/xforce/xfdb/24305

External Source: VUPEN

Name: ADV-2007-2120

Hyperlink:http://www.vupen.com/english/advisories/2007/2120

External Source: VUPEN

Name: ADV-2007-0930

Hyperlink:http://www.vupen.com/english/advisories/2007/0930

External Source: VUPEN

Name: ADV-2006-4869

Hyperlink:http://www.vupen.com/english/advisories/2006/4869

External Source: VUPEN

Name: ADV-2006-2490

Hyperlink:http://www.vupen.com/english/advisories/2006/2490

External Source: VUPEN

Name: ADV-2006-0306

Hyperlink:http://www.vupen.com/english/advisories/2006/0306

External Source: UBUNTU

Name: USN-255-1

Hyperlink:http://www.ubuntu.com/usn/usn-255-1

External Source: TRUSTIX

Name: 2006-0004

Hyperlink:http://www.trustix.org/errata/2006/0004

External Source: BID

Name: 16369

Hyperlink:http://www.securityfocus.com/bid/16369

External Source: FEDORA

Name: FLSA-2006:168935

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/425397/100/0/threaded

External Source: REDHAT

Name: RHSA-2006:0044

Hyperlink:http://www.redhat.com/support/errata/RHSA-2006-0044.html

External Source: OSVDB

Name: 22692

Hyperlink:http://www.osvdb.org/22692

External Source: OPENPKG

Name: OpenPKG-SA-2006.003

Hyperlink:http://www.openpkg.org/security/OpenPKG-SA-2006.003-openssh.html

External Source: SUSE

Name: SUSE-SA:2006:008

Hyperlink:http://www.novell.com/linux/security/advisories/2006_08_openssh.html

External Source: GENTOO

Name: GLSA-200602-11

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200602-11.xml

External Source: SLACKWARE

Name: SSA:2006-045-06

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.425802

External Source: SECTRACK

Name: 1015540

Hyperlink:http://securitytracker.com/id?1015540

External Source: SECUNIA

Name: 19159

Hyperlink:http://secunia.com/advisories/19159

External Source: SECUNIA

Name: 18970

Hyperlink:http://secunia.com/advisories/18970

External Source: SECUNIA

Name: 18969

Hyperlink:http://secunia.com/advisories/18969

External Source: SECUNIA

Name: 18964

Hyperlink:http://secunia.com/advisories/18964

External Source: SECUNIA

Name: 18910

Hyperlink:http://secunia.com/advisories/18910

External Source: SECUNIA

Name: 18850

Hyperlink:http://secunia.com/advisories/18850

External Source: SECUNIA

Name: 18798

Hyperlink:http://secunia.com/advisories/18798

External Source: SECUNIA

Name: 18736

Hyperlink:http://secunia.com/advisories/18736

External Source: SECUNIA

Name: 18650

Hyperlink:http://secunia.com/advisories/18650

External Source: SECUNIA

Name: 18579

Hyperlink:http://secunia.com/advisories/18579

External Source: OVAL

Name: oval:org.mitre.oval:def:9962

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9962

External Source: HP

Name: HPSBUX02178

Hyperlink:http://itrc.hp.com/service/cki/docDisplay.do?docId=c00815112

External Source: OPENBSD

Name: 20060212 [3.8] 005: SECURITY FIX: February 12, 2006

Hyperlink:ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/005_ssh.patch

External Source: CONFIRM

Name: http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=2751

Hyperlink:http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=2751

External Source: CONFIRM

Name: http://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v52.Readme.html#MH00688

Hyperlink:http://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v52.Readme.html#MH00688

External Source: CONFIRM

Name: http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html

Hyperlink:http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html

External Source: CONFIRM

Name: http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html

Hyperlink:http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html

External Source: REDHAT

Name: RHSA-2006:0698

Hyperlink:http://www.redhat.com/support/errata/RHSA-2006-0698.html

External Source: REDHAT

Name: RHSA-2006:0298

Hyperlink:http://www.redhat.com/support/errata/RHSA-2006-0298.html

External Source: MANDRIVA

Name: MDKSA-2006:034

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:034

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2007-246.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2007-246.htm

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2006-262.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2006-262.htm

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2006-174.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2006-174.htm

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2006-158.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2006-158.htm

External Source: SUNALERT

Name: 102961

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102961-1

External Source: SREASON

Name: 462

Hyperlink:http://securityreason.com/securityalert/462

External Source: SECUNIA

Name: 25936

Hyperlink:http://secunia.com/advisories/25936

External Source: SECUNIA

Name: 25607

Hyperlink:http://secunia.com/advisories/25607

External Source: SECUNIA

Name: 24479

Hyperlink:http://secunia.com/advisories/24479

External Source: SECUNIA

Name: 23680

Hyperlink:http://secunia.com/advisories/23680

External Source: SECUNIA

Name: 23340

Hyperlink:http://secunia.com/advisories/23340

External Source: SECUNIA

Name: 23241

Hyperlink:http://secunia.com/advisories/23241

External Source: SECUNIA

Name: 22196

Hyperlink:http://secunia.com/advisories/22196

External Source: SECUNIA

Name: 21724

Hyperlink:http://secunia.com/advisories/21724

External Source: SECUNIA

Name: 21492

Hyperlink:http://secunia.com/advisories/21492

External Source: SECUNIA

Name: 21262

Hyperlink:http://secunia.com/advisories/21262

External Source: SECUNIA

Name: 21129

Hyperlink:http://secunia.com/advisories/21129

External Source: SECUNIA

Name: 20723

Hyperlink:http://secunia.com/advisories/20723

External Source: APPLE

Name: APPLE-SA-2007-03-13

Hyperlink:http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html

External Source: HP

Name: HPSBUX02178

Hyperlink:http://itrc.hp.com/service/cki/docDisplay.do?docId=c00815112

External Source: CONFIRM

Name: http://docs.info.apple.com/article.html?artnum=305214

Hyperlink:http://docs.info.apple.com/article.html?artnum=305214

External Source: CONFIRM

Name: http://blogs.sun.com/security/entry/sun_alert_102961_security_vulnerability

Hyperlink:http://blogs.sun.com/security/entry/sun_alert_102961_security_vulnerability

External Source: SGI

Name: 20060703-01-P

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc

US Government Resource: oval:org.mitre.oval:def:1138

Name: oval:org.mitre.oval:def:1138

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1138

References to Check Content

Identifier:oval:org.mitre.oval:def:9962

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9962

Identifier:oval:org.mitre.oval:def:1138

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:1138

Vulnerable software and versions

Configuration 1

* cpe:/a:openbsd:openssh:3.0

* cpe:/a:openbsd:openssh:3.0.1

* cpe:/a:openbsd:openssh:3.0.1p1

* cpe:/a:openbsd:openssh:3.0.2

* cpe:/a:openbsd:openssh:3.0.2p1

* cpe:/a:openbsd:openssh:3.0p1

* cpe:/a:openbsd:openssh:3.1

* cpe:/a:openbsd:openssh:3.1p1

* cpe:/a:openbsd:openssh:3.2

* cpe:/a:openbsd:openssh:3.2.2p1

* cpe:/a:openbsd:openssh:3.2.3p1

* cpe:/a:openbsd:openssh:3.3

* cpe:/a:openbsd:openssh:3.3p1

* cpe:/a:openbsd:openssh:3.4

* cpe:/a:openbsd:openssh:3.4p1

* cpe:/a:openbsd:openssh:3.5

* cpe:/a:openbsd:openssh:3.5p1

* cpe:/a:openbsd:openssh:3.6

* cpe:/a:openbsd:openssh:3.6.1

* cpe:/a:openbsd:openssh:3.6.1p1

* cpe:/a:openbsd:openssh:3.6.1p2

* cpe:/a:openbsd:openssh:3.7

* cpe:/a:openbsd:openssh:3.7.1

* cpe:/a:openbsd:openssh:3.7.1p2

* cpe:/a:openbsd:openssh:3.8

* cpe:/a:openbsd:openssh:3.8.1

* cpe:/a:openbsd:openssh:3.8.1p1

* cpe:/a:openbsd:openssh:3.9

* cpe:/a:openbsd:openssh:3.9.1

* cpe:/a:openbsd:openssh:3.9.1p1

* cpe:/a:openbsd:openssh:4.0p1

* cpe:/a:openbsd:openssh:4.1p1

* cpe:/a:openbsd:openssh:4.2p1

* Denotes Vulnerable Software

Technical Details

Vulnerability Type (View All)

CVE Standard Vulnerability Entry:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0225