CVE-2019-6110

A vulnerability was found in OpenSSH that could allow a remote attacker to conduct spoofing attacks. This is caused by the acceptance and display of arbitrary stderr output from the SCP server, where a man-in-the-middle attacker could exploit this vulnerability to spoof the SCP client output, misleading the user into thinking the operation was successful or reporting false information.

This vulnerability is rated as a moderate because it allows a malicious server or a Man-in-the-Middle attacker to manipulate client output by injecting arbitrary stderr content, on exploitation this could mislead the user into thinking the operation was successful or reporting false information, it can facilitate social engineering attacks.

This issue affects the scp client shipped with openssh. The SSH protocol or the SSH client is not affected. For more detailed analysis please refer to: https://bugzilla.redhat.com/show_bug.cgi?id=1666124#c2

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This issue only affects the users of scp binary which is a part of openssh-clients package. Other usage of SSH protocol or other ssh clients is not affected. Administrators can uninstall openssh-clients for additional protection against accidental usage of this binary. Removing the openssh-clients package will make binaries like scp and ssh etc unavailable on that system.

Note: To exploit this flaw, the victim needs to connect to a malicious SSH server or MITM (Man-in-the-middle) the scp connection, both of which can be detected by the system administrator via a change in the host key of the SSH server. Further, if connections via scp are made to only trusted SSH servers, then those use-cases are not vulnerable to this security flaw.