Medium · published January 31, 2019
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.
| Product | Versions | Fixed in |
|---|---|---|
| openbsd/openssh | ≤ 7.9 | — |
| winscp/winscp | ≤ 5.13 | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| netapp/element_software | all versions | — |
| netapp/ontap_select_deploy | all versions | — |
| netapp/storage_automation_store | all versions | — |
| fedoraproject/fedora | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| siemens/scalance_x204rna_firmware | < 3.2.7 | 3.2.7 |
| siemens/scalance_x204rna_eec_firmware | < 3.2.7 | 3.2.7 |
| fujitsu/m10-1_firmware | < xcp2361 | xcp2361 |
| fujitsu/m10-4_firmware | < xcp2361 | xcp2361 |
| fujitsu/m10-4s_firmware | < xcp2361 | xcp2361 |
| fujitsu/m12-1_firmware | < xcp2361 | xcp2361 |
| fujitsu/m12-2_firmware | < xcp2361 | xcp2361 |
| fujitsu/m12-2s_firmware | < xcp2361 | xcp2361 |
| fujitsu/m10-1_firmware | < xcp3070 | xcp3070 |
| fujitsu/m10-4_firmware | < xcp3070 | xcp3070 |
| fujitsu/m10-4s_firmware | < xcp3070 | xcp3070 |
| fujitsu/m12-1_firmware | < xcp3070 | xcp3070 |
| fujitsu/m12-2_firmware | < xcp3070 | xcp3070 |
| fujitsu/m12-2s_firmware | < xcp3070 | xcp3070 |