[ GLSA 201801-05 ] OpenSSH

[GLSA]

Gentoo Linux Security Advisory

Title: OpenSSH: Permission issue (GLSA 201801-05)
Severity: normal
Exploitable: remote
Date: 2018-01-07
Bug(s): #633428
ID: 201801-05

Synopsis

A flaw has been discovered in OpenSSH which could allow a remote
attacker to create zero-length files.


Background

OpenSSH is a complete SSH protocol implementation that includes SFTP
client and server support.


Affected Packages

Package: net-misc/openssh
Vulnerable: < 7.5_p1-r3
Unaffected: >= 7.5_p1-r3
Architectures: All supported architectures


Description

The process_open function in sftp-server.c in OpenSSH did not properly
prevent write operations in readonly mode.


Impact

A remote attacker could cause the creation of zero-length files.

Workaround

There is no known workaround at this time.

Resolution

All OpenSSH users should upgrade to the latest version: