CVE-2019-25017

An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious rcp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rcp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). This issue is similar to CVE-2019-6111 and CVE-2019-7283. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.

• CWE-863

• https://bugzilla.suse.com/show_bug.cgi?id=1131109Exploit, Issue Tracking, Third Party Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1131109Exploit, Issue Tracking, Third Party Advisory

Published

Feb 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-25011NetBox through 2.6.2 allows an Authenticated User to conduct…5.4
• CVE-2019-25012The Webform Report project 7.x-1.x-dev for Drupal allows rem…7.5
• CVE-2019-25013The iconv feature in the GNU C Library (aka glibc or libc6) …5.9
• CVE-2019-25014A NULL pointer dereference was found in pkg/proxy/envoy/v2/d…6.5
• CVE-2019-25015LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS vi…5.4
• CVE-2019-25016In OpenDoas from 6.6 to 6.8 the users PATH variable was inco…8.8
• CVE-2019-25018In the rcp client in MIT krb5-appl through 1.0.3, malicious …7.5
• CVE-2019-25019LimeSurvey before 4.0.0-RC4 allows SQL injection via the par…9.8
• CVE-2019-2502Vulnerability in the MySQL Server component of Oracle MySQL …4.9
• CVE-2019-25020An issue was discovered in Scytl sVote 2.1. Because the sdm-…7.5
• CVE-2019-25021An issue was discovered in Scytl sVote 2.1. Due to the imple…7.5
• CVE-2019-25022An issue was discovered in Scytl sVote 2.1. An attacker can …9.8