CVE-2017-15906 The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.
MediumCVSS 5.3
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openssh(Debian:12) | < 1:7.6p1-1 | 1:7.6p1-1 |
| debian/openssh(Debian:13) | < 1:7.6p1-1 | 1:7.6p1-1 |
| debian/openssh(Debian:14) | < 1:7.6p1-1 | 1:7.6p1-1 |
| OpenBSD openssh | < 7.6 | 7.6 |
| oracle sun zfs storage appliance kit | = 8.8.6 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| netapp active iq unified manager | All versions | No fix listed |
| netapp cloud backup | All versions | No fix listed |
| netapp clustered data ontap | All versions | No fix listed |
| netapp data ontap edge | All versions | No fix listed |
| netapp hci management node | All versions | No fix listed |
| netapp oncommand unified manager core package | All versions | No fix listed |
| netapp solidfire | All versions | No fix listed |
| netapp steelstore cloud integrated storage | All versions | No fix listed |
| netapp storage replication adapter for clustered data ontap | >= 9.7 | No fix listed |
| netapp storage replication adapter for clustered data ontap | = 9.6 | No fix listed |
| netapp vasa provider for clustered data ontap | >= 6.0, <= 6.2 | No fix listed |
| netapp vasa provider for clustered data ontap | >= 9.7 | No fix listed |
| netapp virtual storage console | >= 9.7 | No fix listed |
| netapp virtual storage console | = 9.6 | No fix listed |
| netapp cn1610 firmware | All versions | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux eus | = 7.6 | No fix listed |
| redhat enterprise linux eus | = 7.7 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
Show 26 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server aus | = 7.7 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.7 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| alpine/openssh(Alpine:v3.10) | < 7.5_p1-r8 | 7.5_p1-r8 |
| alpine/openssh(Alpine:v3.11) | < 7.5_p1-r8 | 7.5_p1-r8 |
| alpine/openssh(Alpine:v3.12) | < 7.5_p1-r8 | 7.5_p1-r8 |
| alpine/openssh(Alpine:v3.13) | < 7.5_p1-r8 | 7.5_p1-r8 |
| alpine/openssh(Alpine:v3.14) | < 7.5_p1-r8 | 7.5_p1-r8 |
| alpine/openssh(Alpine:v3.15) | < 7.5_p1-r8 | 7.5_p1-r8 |
| alpine/openssh(Alpine:v3.16) | < 7.5_p1-r8 | 7.5_p1-r8 |
| alpine/openssh(Alpine:v3.17) | < 7.5_p1-r8 | 7.5_p1-r8 |
| alpine/openssh(Alpine:v3.18) | < 7.5_p1-r8 | 7.5_p1-r8 |
| alpine/openssh(Alpine:v3.19) | < 7.5_p1-r8 | 7.5_p1-r8 |
| alpine/openssh(Alpine:v3.20) | < 7.5_p1-r8 | 7.5_p1-r8 |
| alpine/openssh(Alpine:v3.21) | < 7.5_p1-r8 | 7.5_p1-r8 |
| alpine/openssh(Alpine:v3.22) | < 7.5_p1-r8 | 7.5_p1-r8 |
| alpine/openssh(Alpine:v3.23) | < 7.5_p1-r8 | 7.5_p1-r8 |
| alpine/openssh(Alpine:v3.24) | < 7.5_p1-r8 | 7.5_p1-r8 |
| alpine/openssh(Alpine:v3.4) | < 7.2_p1-r2 | 7.2_p1-r2 |
| alpine/openssh(Alpine:v3.5) | < 7.4_p1-r1 | 7.4_p1-r1 |
| alpine/openssh(Alpine:v3.6) | < 7.5_p1-r2 | 7.5_p1-r2 |
| alpine/openssh(Alpine:v3.7) | < 7.5_p1-r0 | 7.5_p1-r0 |
| alpine/openssh(Alpine:v3.8) | < 7.5_p1-r8 | 7.5_p1-r8 |
| alpine/openssh(Alpine:v3.9) | < 7.5_p1-r8 | 7.5_p1-r8 |
References
- Debian Security Tracker CVE-2017-15906 vendor-advisory
- 101552 third-party-advisory vdb-entry
- RHSA-2018:0980 third-party-advisory vendor-advisory
- cert-portal.siemens.com
- github.com third-party-advisory
- [debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update mailing-list third-party-advisory
- GLSA-201801-05 third-party-advisory vendor-advisory
- security.netapp.com third-party-advisory
- www.openssh.com release-notes vendor-advisory
- www.oracle.com third-party-advisory
- security.alpinelinux.org vendor-advisory