ROS-20241017-03

Vulnerability of toremote function scp.c of OpenSSH cryptographic protection tool exists due to failure to take measures to neutralize special elements used in the operating system command. Exploitation of the vulnerability could allow an attacker acting remotely to execute an arbitrary command...

The vulnerability of the toremote function in the OpenSSH cryptographic protection mechanism allows a attacker to execute any command they desire.

The vulnerability of the toremote function in the OpenSSH cryptographic protection mechanism exists because measures to neutralize the special elements used in the operating system command are not taken. Exploiting this vulnerability allows a malicious actor to execute any command remotely...

Command injection

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a...