OpenSSH contains a flaw that may allow an attacker to execute arbitrary commands. The flaw is due to the way OpenSSH's scp utility handles file names during local-to-local copies. During the file name expansion, the utility does not properly sanitize filenames allowing a crafted file name with shell meta-characters. This can be used to trick a user into executing arbitrary commands under with a different set of (potentially higher) privileges.

Upgrade to version 4.3p1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1015540
• Bugtraq ID: 16369
• Secunia Advisory ID: 18579 18595 18650 18736 18798 18850 18910 18964 18969 18970 19159 20723 21129 21262 21492 21724 22196 23241 23340 23680 25607 25936
• SCIP VulDB ID: 1999 3113
• CVE ID: 2006-0225 (see also: NVD)
• ISS X-Force ID: 24305
• VUPEN Advisory: ADV-2006-0306 ADV-2006-2490 ADV-2006-4869 ADV-2007-0930
• Vendor Specific Advisory URL: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc http://docs.info.apple.com/article.html?artnum=305214
  http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA
  http://lists.suse.de/archive/suse-security-announce/2006-Feb/0004.html
  http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.425802
  http://support.avaya.com/elmodocs2/security/ASA-2006-158.htm
  http://support.avaya.com/elmodocs2/security/ASA-2006-174.htm
  http://support.avaya.com/elmodocs2/security/ASA-2006-262.htm
  http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2012-08-686&viewMode=view
  http://www.trustix.org/errata/2006/0004/
  http://www.ubuntu.com/usn/usn-255-1
  http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html
  http://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v52.Readme.html#MH00688
  http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:034
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-12/0091.html
  http://archives.neohapsis.com/archives/bugtraq/2006-12/0306.html
  http://attrition.org/pipermail/vim/2007-May/001617.html
• Vendor Specific News/Changelog Entry: http://bugs.gentoo.org/show_bug.cgi?id=119232
  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=174026
• Other Advisory URL: http://sunsolve.sun.com/search/document.do?assetkey=1-26-102961-1
  http://support.avaya.com/elmodocs2/security/ASA-2007-246.htm
  http://www.gentoo.org/security/en/glsa/glsa-200602-11.xml
  http://www.openbsd.org/errata.html#ssh
• RedHat RHSA: RHSA-2006:0044 RHSA-2006:0298 RHSA-2006:0698

• Josh Bressers -