CVE-2017-15906

EPSS 3.36%
Veröffentlicht 26.10.2017 03:29:00
Zuletzt bearbeitet 28.05.2026 19:16:25
Erkennungen
Login

The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 12

NVD 27 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Openbsd ≫ Openssh Version < 7.6

Oracle ≫ Sun Zfs Storage Appliance Kit Version 8.8.6

Debian ≫ Debian Linux Version 8.0

Netapp ≫ Active Iq Unified Manager Version - SwPlatform vmware_vsphere

Netapp ≫ Cloud Backup Version -

Netapp ≫ Clustered Data Ontap Version -

Netapp ≫ Data Ontap Edge Version -

Netapp ≫ Hci Management Node Version -

Netapp ≫ Oncommand Unified Manager Core Package Version -

Netapp ≫ Solidfire Version -

Netapp ≫ Steelstore Cloud Integrated Storage Version -

Netapp ≫ Storage Replication Adapter For Clustered Data Ontap SwPlatform vmware_vsphere Version >= 9.7

Netapp ≫ Storage Replication Adapter For Clustered Data Ontap Version 9.6 SwPlatform vmware_vsphere

Netapp ≫ Vasa Provider For Clustered Data Ontap Version >= 6.0 <= 6.2

Netapp ≫ Vasa Provider For Clustered Data Ontap Version >= 9.7

Netapp ≫ Virtual Storage Console SwPlatform vmware_vsphere Version >= 9.7

Netapp ≫ Virtual Storage Console Version 9.6 SwPlatform vmware_vsphere

Netapp ≫ Cn1610 Firmware Version -

Netapp ≫ Cn1610 Version -

Redhat ≫ Enterprise Linux Desktop Version 7.0

Redhat ≫ Enterprise Linux Eus Version 7.6

Redhat ≫ Enterprise Linux Eus Version 7.7

Redhat ≫ Enterprise Linux Server Version 7.0

Redhat ≫ Enterprise Linux Server Aus Version 7.6

Redhat ≫ Enterprise Linux Server Aus Version 7.7

Redhat ≫ Enterprise Linux Server Tus Version 7.6

Redhat ≫ Enterprise Linux Server Tus Version 7.7

Redhat ≫ Enterprise Linux Workstation Version 7.0

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	3.36%	0.871

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NIST	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:P/A:N
CISA-ADP	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

https://www.oracle.com/security-alerts/cpujan2020.html

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html

Third Party Advisory

Mailing List

http://www.securityfocus.com/bid/101552

Third Party Advisory

VDB Entry

https://access.redhat.com/errata/RHSA-2018:0980

Third Party Advisory

https://github.com/openbsd/src/commit/a6981567e8e215acc1ef690c8dbb30f2d9b00a19

Third Party Advisory

https://security.gentoo.org/glsa/201801-05

Third Party Advisory

https://security.netapp.com/advisory/ntap-20180423-0004/

Third Party Advisory

https://www.openssh.com/txt/release-7.6

Vendor Advisory

Release Notes

https://nvd.nist.gov/vuln/detail/CVE-2017-15906

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-15906

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-15906

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2017-15906