Note: This is an archival copy of Security Sun Alert 200867 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000657.1.
Solaris 9 Operating System
Solaris 10 Operating System
Date of Workaround Release
Date of Resolved Release
Due to a security vulnerability in the way the scp(1) command executes helper applications, certain additional unintended commands may be executed at the same time. This may allow a local unprivileged user (or a remote user in the case of shared filesystems) who is able to create files on the system, to execute arbitrary commands with the privileges of a local user, if those files are acted upon by the local user using the scp(1) command.
This issue is also referenced in the following document:
CVE-2006-0225 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0225
This issue can occur in the following releases:
Note: Solaris 8 does not include the scp(1) command and is therefore not impacted by this issue.
There are no predictable symptoms that would indicate that this issue has been exploited to execute arbitrary commands.
This issue will only occur if the scp(1) command is executed on files that have specially crafted filenames. Therefore, it may be possible to work around this issue by avoiding the use of the scp(1) command on untrusted filenames, for example, on directories that are writable by untrusted users.
This issue is addressed in the following releases:
This solution has no attachment