Command : scp SomeLocalFile USER@Host:/ # in fact the / was a type-o Password for USER was given and entered File was created .. under root of HOST . However ls -la of that ROOT directory showed 755 rights and owned by root. So USER is NOT allowed to write files there. This can mean that any user can copy a file over the vmlinux kernel This is a SEVER error. I do not know if other versions of ssh/scp are affected. My version is 2.6.1P2 (Debian SID)
yume:~ mouring$ scp x mouring@SITE:/ Enter passphrase for key '/Users/mouring/.ssh/id_rsa': scp: /x: Permission denied yume:~ mouring$ ssh -V OpenSSH_3.6.1p1+CAN-2003-0693, SSH protocols 1.5/2.0, OpenSSL 0x0090702f I can't replicate this with Apple ssh (which is OpenSSH Portable + GSSAPI + security patches). Plus somehow I doubt this bug is even valid since the remote 'scp' is ran as USER@
tim@uw713-UnixWare 210% ls -ld / drwxr-xr-x 47 root sys 4096 Feb 26 03:26 / tim@uw713-UnixWare 211% scp /tmp/x tim@localhost:/ tim@localhost's password: scp: /x: Permission denied tim@uw713-UnixWare 212% ssh -V OpenSSH_3.6.1p2, SSH protocols 1.5/2.0, OpenSSL 0x0090702f tim@uw713-UnixWare 213% tim@ibm365 52% Can't duplicate here.
Can you recreate with OpenSSH 3.8p1?
Debian uses PAM by default, maybe it's a PAM-specific thing? Wim, please record the output of "scp -vvv SomeLocalFile USER@Host:/; ssh USER@Host ls -l /SomeLocalFile" and use "Create a New Attachment" to attach it to this bug. Also, if the bug is with the Debian-supplied package, have you reported it to Debian?
On Debian with ssh 3.8p1-2: [cjwatson@cairhien ~]$ ls -l foo -rw-r--r-- 1 cjwatson cjwatson 0 Mar 30 11:30 foo [cjwatson@cairhien ~]$ ls -ld / drwxr-xr-x 23 root root 4096 Mar 22 02:47 / [cjwatson@cairhien ~]$ scp foo cjwatson@localhost:/ scp: /foo: Permission denied I can't think of anything PAM-related that might cause this.
Since none of us can reproduce this, without the debugging info there's nothing else we can do. Please reopen if you have the debugging to attach. (Thanks Colin).
i've seen people installing scp setuid root. then things like this happen.
Mass change of RESOLVED bugs to CLOSED