Description
C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt, letting attackers modify files such as shell startup files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenKermit | C-Kermit | 6.0.192 – < 11.1.515 | 11.1.515 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ckermit | 1:11.1.515-1 | — |
| Debian 13 | ckermit | No fix yet | — |
| Debian 12 | ckermit | No fix yet | — |
References
- GitHub Security Advisory (GHSA-vhrv-7jrq-95qj) vendor-advisory
- https://github.com/OpenKermit/ckermit/commit/bbf9923e3e2e04ac3da713998cb15e786e26fdf1 patch
- C-Kermit v11.1.515 Release Notes release-notes
- https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcfn3.c#L1798-L1800 technical-description
- VulnCheck Advisory: C-Kermit 6.0.192 before 11.1.515 File Collision Protection Bypass via RESEND third-party-advisory