Huawei EulerOS: Security Advisory for openssh (EulerOS-SA-2019-1355)

The remote host is missing an update for the Huawei EulerOS 'openssh' package(s) announced via the EulerOS-SA-2019-1355 advisory.

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.(CVE-2019-6109) An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).(CVE-2019-6111)

'openssh' package(s) on Huawei EulerOS Virtualization 2.5.3.

Checks if a vulnerable package version is present on the target host.

Please install the updated package(s).