{"id":83061,"date":"2020-05-28T01:42:22","date_gmt":"2020-05-27T23:42:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp"},"modified":"2020-05-28T01:42:22","modified_gmt":"2020-05-27T23:42:22","slug":"reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","title":{"rendered":"Release of OpenSSH 8.3 with a vulnerability fix in scp","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

After three months of development introduced<\/a><\/noindex> release OpenSSH 8.3<\/a><\/noindex>, an open implementation of a client and server for working with SSH 2.0 and SFTP protocols. <\/p>\n

The new release introduces protection against an attack on scp, allowing the server to transmit different filenames from those requested (unlike the previous vulnerability<\/a><\/noindex>, the attack does not allow changing the user-selected directory or glob pattern). It is worth noting that in SCP, the server decides which files and directories to send to the client, while the client only verifies the correctness of the returned object names. The essence of the identified issue is that if the system call utimes fails, the file content is interpreted as file metadata. <\/p>\n

This feature, when connecting to a server controlled by an attacker, can be used to save different file names and other content in the user's file system when copying using scp in configurations that cause a failure when calling utimes (for example, when utimes is prohibited by SELinux policy or a system call filter). The likelihood of real attacks is assessed as minimal since in typical configurations the utimes call does not fail. Furthermore, the attack does not go unnoticed \u2014 an error is displayed when using scp.<\/p>\n

General changes:<\/p>\n