CVE-2006-0225 json
scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are ex…
published 2006-01-25 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-0233
- cvss
- 4.6
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.
Patch / fix
- openssh Debian 14, Debian 13, Debian 12 1:4.3p2-1
- dropbear Debian 14, Debian 13, Debian 12 0.48-1
debian advisories DEBIAN-CVE-2006-0225
- openssh RHEL 2.1 3.1p1-21
- openssh-server RHEL 2.1 3.1p1-21
- openssh-askpass RHEL 2.1 3.1p1-21
- openssh-clients RHEL 2.1 3.1p1-21
- openssh-askpass-gnome RHEL 2.1 3.1p1-21
- openssh RHEL 3 3.6.1p2-33.30.9
- openssh-server RHEL 3 3.6.1p2-33.30.9
- openssh-askpass RHEL 3 3.6.1p2-33.30.9
red hat advisories RHSA-2006:0698RHSA-2006:0298RHSA-2006:0044
- openssh openSUSE Tumbleweed 8.4p1-7.4
opensuse advisories openSUSE-SU-2024:11124-1
- secunia.com/advisories/18595 advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2006-0225 updated
local to local copy uses shell expansion twice
-
Red Hat Desktop version 3 openssh 3.6.1p2-33.30.9, openssh-server 3.6.1p2-33.30.9, openssh-askpass 3.6.1p2-33.30.9, openssh-clients 3.6.1p2-33.30.9, openssh-askpass-gnome 3.6.1p2-33.30.9fixed: vendor fix RHSA-2006:0298
-
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 openssh 3.1p1-21, openssh-server 3.1p1-21, openssh-askpass 3.1p1-21, openssh-clients 3.1p1-21, openssh-askpass-gnome 3.1p1-21fixed: vendor fix RHSA-2006:0698
-
Red Hat Enterprise Linux AS version 3 openssh 3.6.1p2-33.30.9, openssh-server 3.6.1p2-33.30.9, openssh-askpass 3.6.1p2-33.30.9, openssh-clients 3.6.1p2-33.30.9, openssh-askpass-gnome 3.6.1p2-33.30.9fixed: vendor fix RHSA-2006:0298
-
Red Hat Enterprise Linux AS version 4 openssh 3.9p1-8.RHEL4.12, openssh-server 3.9p1-8.RHEL4.12, openssh-askpass 3.9p1-8.RHEL4.12, openssh-clients 3.9p1-8.RHEL4.12, openssh-askpass-gnome 3.9p1-8.RHEL4.12 Red Hat Enterprise Linux Desktop version 4 openssh 3.9p1-8.RHEL4.12, openssh-server 3.9p1-8.RHEL4.12, openssh-askpass 3.9p1-8.RHEL4.12, openssh-clients 3.9p1-8.RHEL4.12, openssh-askpass-gnome 3.9p1-8.RHEL4.12fixed: vendor fix RHSA-2006:0044
-
Red Hat Enterprise Linux ES version 2.1 openssh 3.1p1-21, openssh-server 3.1p1-21, openssh-askpass 3.1p1-21, openssh-clients 3.1p1-21, openssh-askpass-gnome 3.1p1-21fixed: vendor fix RHSA-2006:0698
-
Red Hat Enterprise Linux ES version 3 openssh 3.6.1p2-33.30.9, openssh-server 3.6.1p2-33.30.9, openssh-askpass 3.6.1p2-33.30.9, openssh-clients 3.6.1p2-33.30.9, openssh-askpass-gnome 3.6.1p2-33.30.9fixed: vendor fix RHSA-2006:0298
-
Red Hat Enterprise Linux ES version 4 openssh 3.9p1-8.RHEL4.12, openssh-server 3.9p1-8.RHEL4.12, openssh-askpass 3.9p1-8.RHEL4.12, openssh-clients 3.9p1-8.RHEL4.12, openssh-askpass-gnome 3.9p1-8.RHEL4.12fixed: vendor fix RHSA-2006:0044
-
Red Hat Enterprise Linux WS version 2.1 openssh 3.1p1-21, openssh-server 3.1p1-21, openssh-askpass 3.1p1-21, openssh-clients 3.1p1-21, openssh-askpass-gnome 3.1p1-21fixed: vendor fix RHSA-2006:0698
show 3 moreshow fewer
-
Red Hat Enterprise Linux WS version 3 openssh 3.6.1p2-33.30.9, openssh-server 3.6.1p2-33.30.9, openssh-askpass 3.6.1p2-33.30.9, openssh-clients 3.6.1p2-33.30.9, openssh-askpass-gnome 3.6.1p2-33.30.9fixed: vendor fix RHSA-2006:0298
-
Red Hat Enterprise Linux WS version 4 openssh 3.9p1-8.RHEL4.12, openssh-server 3.9p1-8.RHEL4.12, openssh-askpass 3.9p1-8.RHEL4.12, openssh-clients 3.9p1-8.RHEL4.12, openssh-askpass-gnome 3.9p1-8.RHEL4.12fixed: vendor fix RHSA-2006:0044
-
Red Hat Linux Advanced Workstation 2.1 openssh 3.1p1-21, openssh-server 3.1p1-21, openssh-askpass 3.1p1-21, openssh-clients 3.1p1-21, openssh-askpass-gnome 3.1p1-21fixed: vendor fix RHSA-2006:0698
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
0.47% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
References
-
secunia.com
/advisories/18595
patch, vendor-advisory
-
itrc.hp.com
/service/cki/docDisplay.do?docId=c00815112
vendor-advisory
-
redhat.com
/support/errata/RHSA-2006-0298.html
vendor-advisory
-
trustix.org
/errata/2006/0004
vendor-advisory
-
lists.apple.com
/archives/security-announce/2007/Mar/msg00002.html
vendor-advisory
-
mandriva.com
/security/advisories?name=MDKSA-2006:034
vendor-advisory
-
openpkg.org
/security/OpenPKG-SA-2006.003-openssh.html
vendor-advisory
-
securityfocus.com
/archive/1/425397/100/0/threaded
vendor-advisory
-
redhat.com
/support/errata/RHSA-2006-0044.html
vendor-advisory
-
novell.com
/linux/security/advisories/2006_08_openssh.html
vendor-advisory
-
slackware.com
/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.425802
vendor-advisory
-
redhat.com
/archives/fedora-announce-list/2006-January/msg00062.html
vendor-advisory
-
gentoo.org
/security/en/glsa/glsa-200602-11.xml
vendor-advisory
-
sunsolve.sun.com
/search/document.do?assetkey=1-26-102961-1
vendor-advisory
-
redhat.com
/support/errata/RHSA-2006-0698.html
vendor-advisory
-
ubuntu.com
/usn/usn-255-1
vendor-advisory
-
securityfocus.com
/bid/16369
vdb-entry
-
secunia.com
/advisories/25936
third-party-advisory
-
secunia.com
/advisories/18798
third-party-advisory
- vmware.com /support/vi3/doc/esx-3069097-patch.html
- www14.software.ibm.com /webapp/set2/sas/f/hmc/power5/install/v52.Readme.html#MH00688
-
secunia.com
/advisories/23340
third-party-advisory
-
secunia.com
/advisories/18970
third-party-advisory
-
secunia.com
/advisories/21492
third-party-advisory
-
us-cert.gov
/cas/techalerts/TA07-072A.html
third-party-advisory
- support.avaya.com /elmodocs2/security/ASA-2006-262.htm
-
secunia.com
/advisories/19159
third-party-advisory
-
secunia.com
/advisories/18650
third-party-advisory
-
secunia.com
/advisories/18736
third-party-advisory
-
osvdb.org
/22692
vdb-entry
-
vupen.com
/english/advisories/2007/2120
vdb-entry
-
secunia.com
/advisories/23680
third-party-advisory
-
secunia.com
/advisories/18579
third-party-advisory
-
secunia.com
/advisories/18969
third-party-advisory
-
secunia.com
/advisories/20723
third-party-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/24305
vdb-entry
-
securityreason.com
/securityalert/462
third-party-advisory
- docs.info.apple.com /article.html?artnum=305214
- support.avaya.com /elmodocs2/security/ASA-2006-158.htm
-
vupen.com
/english/advisories/2006/4869
vdb-entry
-
secunia.com
/advisories/21262
third-party-advisory
- blogs.sun.com /security/entry/sun_alert_102961_security_vulnerability
- secunia.com /advisories/18850
- secunia.com /advisories/18910
- secunia.com /advisories/18964
- secunia.com /advisories/21129
- secunia.com /advisories/21724
- secunia.com /advisories/22196
- secunia.com /advisories/23241
- secunia.com /advisories/24479
- secunia.com /advisories/25607
- securitytracker.com /id?1015540
- support.avaya.com /elmodocs2/security/ASA-2006-174.htm
- support.avaya.com /elmodocs2/security/ASA-2007-246.htm
Sources
- CVE List CVE-2006-0225
- NVD CVE-2006-0225
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.