Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2019-25017

EPSS 0.61% · P70
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2019-25017

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious rcp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rcp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). This issue is similar to CVE-2019-6111 and CVE-2019-7283. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
MIT Kerberos 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MIT Kerberos是美国麻省理工（MIT）的一个用于在网络集群中进行身份验证的软件。Kerberos 同时作为一种网络认证协议，其设计目标是通过密钥系统为客户机 / 服务器应用程序提供强大的认证服务。 MIT krb5-appl through 1.0.3 存在安全漏洞，攻击者可利用该漏洞覆盖rcp客户端目标目录中的任意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
-n/a n/a -

II. Public POCs for CVE-2019-25017

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2019-25017

请登录查看更多情报信息。

Same Patch Batch · n/a · 2021-02-02 · 38 CVEs total

CVE-2020-77759.8 CRITICALCommand Injection
CVE-2020-284948.6 HIGHCommand Injection
CVE-2020-284957.3 HIGHPrototype Pollution
CVE-2020-284986.8 MEDIUMCryptographic Issues
CVE-2021-0359Google Android 缓冲区错误漏洞
CVE-2020-8672多款Intel产品缓冲区错误漏洞
CVE-2020-24490Linux kernel 缓冲区错误漏洞
CVE-2021-0365Google Android 资源管理错误漏洞
CVE-2021-0364Google Android 命令注入漏洞
CVE-2021-0363Google Android 命令注入漏洞
CVE-2021-0362Google Android 缓冲区错误漏洞
CVE-2021-0361Google Android 缓冲区错误漏洞
CVE-2021-0360Google Android 缓冲区错误漏洞
CVE-2020-8734Intel Server Board M10JNP2SB 输入验证错误漏洞
CVE-2021-0358Google Android 命令注入漏洞
CVE-2021-0357Google Android 缓冲区错误漏洞
CVE-2021-0356Google Android 命令注入漏洞
CVE-2021-0355Google Android 输入验证错误漏洞
CVE-2021-0354Google Android 输入验证错误漏洞
CVE-2021-0353Google Android 缓冲区错误漏洞

Showing top 20 of 38 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2019-25017

No comments yet

Leave a comment