CVE-2016-5725 Improper Limitation of a Pathname to a Restricted Directory in JCraft JSch
MediumCVSS 5.9
EPSS 24.1%
Public exploit
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.jcraft/jsch(Maven) | <= 0.1.53 | No fix listed |
| debian/jsch(Debian:12) | < 0.1.54-1 | 0.1.54-1 |
| debian/jsch(Debian:14) | < 0.1.54-1 | 0.1.54-1 |
| debian/jsch(Debian:13) | < 0.1.54-1 | 0.1.54-1 |
| com.jcraft/jsch(Maven) | < 0.1.54 | 0.1.54 |
| com.jcraft/jsch(Maven) | = 0.1.23 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.24 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.25 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.27 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.29 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.31 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.38 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.41 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.42 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.43 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.43-1 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.44 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.44-1 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.45 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.46 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.47 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.48 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.49 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.50 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.51 | No fix listed |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| com.jcraft/jsch(Maven) | = 0.1.52 | No fix listed |
| com.jcraft/jsch(Maven) | = 0.1.53 | No fix listed |
| jcraft jsch | <= 0.1.53 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2017:3115 vendor-advisory
- github.com exploit third-party-advisory
- [debian-lts-announce] 20200425 [SECURITY] [DLA 2184-1] jsch security update mailing-list
- 40411 exploit third-party-advisory vdb-entry
- www.oracle.com
- www.oracle.com
- www.oracle.com
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20160921 CVE-2016-5725 - JCraft/JSch Java Secure Channel <= 0.1.53 recursive sftp-get path traversal (client-side, windows) mailing-list third-party-advisory
- www.jcraft.com release-notes
- github.com
- Debian Security Tracker CVE-2016-5725 vendor-advisory
- 93100 third-party-advisory vdb-entry