CVE-2019-25018

In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

1.61% chance of exploitation in the next 30 days, 74th percentile

Published

2021-02-02

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://bugzilla.suse.com/show_bug.cgi?id=1131109

References

• CVE Record
• NVD entry

Related

• CVE-2019-25017
• CVE-2019-25023
• CVE-2019-25016
• CVE-2019-25024
• CVE-2019-25011
• CVE-2019-25046