CVE-2020-12062: openbsd openssh Improper Input Validation

Vulnerability summary

CVE-2020-12062 is a high (CVSS 7.5) Improper Input Validation vulnerability in openbsd openssh. EPSS estimates a 2.23% chance of exploitation in the next 30 days, higher than 82.5% of scored vulnerabilities.

Timeline

1. 01-06-2020
   PublishedVulnerability first disclosed.
2. 14-10-2026
   Last modifiedVulnerability information updated.

Description

The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.