CVE-2019-25018: 
Linux Red Hat vulnerability analysis and mitigation

In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename. The vulnerability was discovered in early 2021 and assigned CVE-2019-25018. This vulnerability affects the MIT krb5-appl package, which is not supported upstream but is still shipped by some Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (krb5) product many years ago, at version 1.8 (NVD).

The vulnerability stems from insufficient validation of filenames in the rcp client implementation. When receiving files from a server, the client does not properly validate the filenames, allowing malicious servers to manipulate the target directory permissions on the client side. This vulnerability is similar to CVE-2018-20685 and CVE-2019-7282. The CVSS v3.1 base score is 7.5 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (NVD).

The primary impact of this vulnerability is that it allows malicious servers to modify the permissions of the target directory on the client side. This could potentially lead to privilege escalation or unauthorized access to sensitive files on the client system (NVD).

The vulnerability can be exploited by a malicious server or a man-in-the-middle attacker when a client uses the rcp command to transfer files. The exploitation requires no special privileges or user interaction, making it relatively straightforward to exploit in scenarios where an attacker can control the server or intercept the connection (SUSE Bugzilla).

The primary mitigation is to upgrade to MIT Kerberos 5 (krb5) version 1.8 or later, which has removed the vulnerable code. For systems still using krb5-appl, SUSE has released security updates to address this vulnerability through SUSE-SU-2021:0527-1 (SUSE Bugzilla).