K54336216 : SCP vulnerability CVE-2019-6679

Security Advisory Description

The system does not properly enforce the access controls for the scp.whitelist and scp.blacklist files when paths are symbolic links (symlinks). This allows authenticated users with Secure Copy (SCP) protocol access to overwrite certain configuration files that would otherwise be restricted. (CVE-2019-6679)

Note: F5 is working to eliminate exclusionary language in our products and documentation. For more information, refer to K34150231: Exclusionary language in F5 products and documentation.

Impact

BIG-IP
Authenticated users with access to the Secure Copy utility (
scp), which is an OpenSSH tool, but without full file system—or Advanced Shell (bash
)—access, can overwrite certain configuration files.
BIG-IQ / Enterprise Manager / Traffix SDC
There is no impact; these F5 products are not affected by this vulnerability.