The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances.

The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol and utimes does not fail under normal circumstances.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system     call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files     in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The     victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted     subdirectory. NOTE: the vendor points out that this attack can achieve no more than a hostile peer is     already able to achieve within the scp protocol and utimes does not fail under normal circumstances.
    (CVE-2020-12062)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the version of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - ** DISPUTED ** The scp client in OpenSSH 8.2     incorrectly sends duplicate responses to the server     upon a utimes system call failure, which allows a     malicious unprivileged user on the remote server to     overwrite arbitrary files in the client's download     directory by creating a crafted subdirectory anywhere     on the remote server. The victim must use the command     scp -rp to download a file hierarchy containing,     anywhere inside, this crafted subdirectory. NOTE: the     vendor points out that 'this attack can achieve no more     than a hostile peer is already able to achieve within     the scp protocol' and 'utimes does not fail under     normal circumstances.'(CVE-2020-12062)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - The scp client in OpenSSH 8.2 incorrectly sends     duplicate responses to the server upon a utimes system     call failure, which allows a malicious unprivileged     user on the remote server to overwrite arbitrary files     in the client's download directory by creating a     crafted subdirectory anywhere on the remote server. The     victim must use the command scp -rp to download a file     hierarchy containing, anywhere inside, this crafted     subdirectory. NOTE: the vendor points out that 'this     attack can achieve no more than a hostile peer is     already able to achieve within the scp protocol' and     'utimes does not fail under normal     circumstances.'(CVE-2020-12062)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The scp client in OpenSSH 8.2 incorrectly sends     duplicate responses to the server upon a utimes system     call failure, which allows a malicious unprivileged     user on the remote server to overwrite arbitrary files     in the client's download directory by creating a     crafted subdirectory anywhere on the remote server. The     victim must use the command scp -rp to download a file     hierarchy containing, anywhere inside, this crafted     subdirectory.(CVE-2020-12062)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The scp client in OpenSSH 8.2 incorrectly sends     duplicate responses to the server upon a utimes system     call failure, which allows a malicious unprivileged     user on the remote server to overwrite arbitrary files     in the client's download directory by creating a     crafted subdirectory anywhere on the remote server. The     victim must use the command scp -rp to download a file     hierarchy containing, anywhere inside, this crafted     subdirectory. NOTE: the vendor points out that 'this     attack can achieve no more than a hostile peer is     already able to achieve within the scp protocol' and     'utimes does not fail under normal     circumstances.'(CVE-2020-12062)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the openssh packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - ** DISPUTED ** The scp client in OpenSSH 8.2     incorrectly sends duplicate responses to the server     upon a utimes system call failure, which allows a     malicious unprivileged user on the remote server to     overwrite arbitrary files in the client's download     directory by creating a crafted subdirectory anywhere     on the remote server. The victim must use the command     scp -rp to download a file hierarchy containing,     anywhere inside, this crafted subdirectory. NOTE: the     vendor points out that 'this attack can achieve no more     than a hostile peer is already able to achieve within     the scp protocol' and 'utimes does not fail under     normal circumstances.'(CVE-2020-12062)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the openssh package has been released.

ID	Name	Product	Family	Severity
504214	Siemens SIMATIC S7-1500 Improper Input Validation (CVE-2020-12062)	Tenable OT Security	Tenable.ot	high
252178	Linux Distros Unpatched Vulnerability : CVE-2020-12062	Nessus	Misc.	high
151391	EulerOS Virtualization 3.0.2.2 : openssh (EulerOS-SA-2021-2153)	Nessus	Huawei Local Security Checks	high
142566	EulerOS Virtualization 3.0.6.6 : openssh (EulerOS-SA-2020-2451)	Nessus	Huawei Local Security Checks	high
142259	EulerOS 2.0 SP2 : openssh (EulerOS-SA-2020-2376)	Nessus	Huawei Local Security Checks	high
140879	EulerOS 2.0 SP3 : openssh (EulerOS-SA-2020-2112)	Nessus	Huawei Local Security Checks	high
140348	EulerOS Virtualization for ARM 64 3.0.2.0 : openssh (EulerOS-SA-2020-1978)	Nessus	Huawei Local Security Checks	high
140149	EulerOS 2.0 SP5 : openssh (EulerOS-SA-2020-1928)	Nessus	Huawei Local Security Checks	high
139148	EulerOS 2.0 SP8 : openssh (EulerOS-SA-2020-1818)	Nessus	Huawei Local Security Checks	high
137797	EulerOS Virtualization for ARM 64 3.0.6.0 : openssh (EulerOS-SA-2020-1690)	Nessus	Huawei Local Security Checks	high
137724	Photon OS 3.0: Openssh PHSA-2020-3.0-0103	Nessus	PhotonOS Local Security Checks	high
137714	Photon OS 2.0: Openssh PHSA-2020-2.0-0253	Nessus	PhotonOS Local Security Checks	high
137640	Photon OS 1.0: Openssh PHSA-2020-1.0-0301	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2020-12062

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high