Description
scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dropbear | 0.48-1 | — |
| Debian 14 | openssh | 1:4.3p2-1 | — |
| Debian 13 | dropbear | 0.48-1 | — |
| Debian 13 | openssh | 1:4.3p2-1 | — |
| Debian 12 | dropbear | 0.48-1 | — |
| Debian 12 | openssh | 1:4.3p2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | openssh +4 | 3.9p1-8.RHEL4.12 | RHSA-2006:0044 |
| RHEL 3 | openssh +4 | 3.6.1p2-33.30.9 | RHSA-2006:0298 |
| RHEL 2 | openssh +4 | 3.1p1-21 | RHSA-2006:0698 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssh | 8.4p1-7.4 | openSUSE-SU-2024:11124-1 |
Advisories 4
- RHSA-2006:0698 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0298 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0044 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:11124-1 openssh-8.4p1-7.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 16369 vdb-entry
- HPSBUX02178 vendor-advisory
- 25936 third-party-advisory
- 18798 third-party-advisory
- http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html
- http://www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v52.Readme.html#MH00688
- 23340 third-party-advisory
- RHSA-2006:0298 vendor-advisory
- 18970 third-party-advisory
- 21492 third-party-advisory
- TA07-072A third-party-advisory
- 2006-0004 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-262.htm
- 19159 third-party-advisory
- 18650 third-party-advisory
- 18736 third-party-advisory
- 22692 vdb-entry
- ADV-2007-2120 vdb-entry
- 23680 third-party-advisory
- APPLE-SA-2007-03-13 vendor-advisory
- 18579 third-party-advisory
- 18969 third-party-advisory
- 20723 third-party-advisory
- openssh-scp-command-execution(24305) vdb-entry
- MDKSA-2006:034 vendor-advisory
- 462 third-party-advisory
- http://docs.info.apple.com/article.html?artnum=305214
- http://support.avaya.com/elmodocs2/security/ASA-2006-158.htm
- ADV-2006-4869 vdb-entry
- OpenPKG-SA-2006.003 vendor-advisory
- FLSA-2006:168935 vendor-advisory
- RHSA-2006:0044 vendor-advisory
- 21262 third-party-advisory
- 25607 third-party-advisory
- http://blogs.sun.com/security/entry/sun_alert_102961_security_vulnerability
- SUSE-SA:2006:008 vendor-advisory
- http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=2751
- ADV-2006-2490 vdb-entry
- ADV-2006-0306 vdb-entry
- SSA:2006-045-06 vendor-advisory
- oval:org.mitre.oval:def:1138 vdb-entry signature
- 21129 third-party-advisory
- 1015540 vdb-entry
- FEDORA-2006-056 vendor-advisory
- 21724 third-party-advisory
- GLSA-200602-11 vendor-advisory
- 23241 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-174.htm
- ADV-2007-0930 vdb-entry
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=174026
- 102961 vendor-advisory
- http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html
- 18850 third-party-advisory
- 22196 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-246.htm
- RHSA-2006:0698 vendor-advisory
- 18595 third-party-advisory
- 18964 third-party-advisory
- USN-255-1 vendor-advisory
- oval:org.mitre.oval:def:9962 vdb-entry signature