Fluid Attacks Database

Description

scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 12	openssh	>=0 <1:4.3p2-1	1:4.3p2-1
debian 13	openssh	>=0 <1:4.3p2-1	1:4.3p2-1
debian 14	openssh	>=0 <1:4.3p2-1	1:4.3p2-1
debian 11	openssh	>=0 <1:4.3p2-1	1:4.3p2-1
debian 11	dropbear	>=0 <0.48-1	0.48-1
debian 13	dropbear	>=0 <0.48-1	0.48-1
debian 14	dropbear	>=0 <0.48-1	0.48-1
debian 12	dropbear	>=0 <0.48-1	0.48-1

Aliases

1. CVE-2006-02252. NVD-2006-02253. OSV-DEBIAN-2006-02254. OSV-2006-02255. SECURITY-TRACKER-CVE-2006-0225

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.