CVE-2006-0225
scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain...
4.6 MediumFix available
scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.
Exploit likelihood
0.47%Down 1.1 points since Feb 4, 2022
What each source reports
NVD Score used
scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.
- Record
CVE-2006-0225- CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.
- Record
CVE-2006-0225- Updated
- 2026-11-02
EUVDEUVD-2006-0233 No score
scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.
- Record
EUVD-2006-0233- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fjc8-474c-2xx3 No score
scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain...
scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.
- Record
GHSA-fjc8-474c-2xx3- Updated
- 2026-11-02
OSV No score
scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.
- Record
CVE-2006-0225- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-0225 No score
scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.
- Record
DEBIAN-CVE-2006-0225- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11124-1 No score
openssh-8.4p1-7.4 on GA media
These are all security issues fixed in the openssh-8.4p1-7.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11124-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dropbearDebian:12 |
before 0.48-1 | 0.48-1 |
dropbearDebian:13 |
before 0.48-1 | 0.48-1 |
dropbearDebian:14 |
before 0.48-1 | 0.48-1 |
opensshDebian:12 |
before 1:4.3p2-1 | 1:4.3p2-1 |
opensshDebian:13 |
before 1:4.3p2-1 | 1:4.3p2-1 |
opensshDebian:14 |
before 1:4.3p2-1 | 1:4.3p2-1 |
opensshRed Hat:enterprise_linux:4::as |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-askpassRed Hat:enterprise_linux:4::as |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-askpass-gnomeRed Hat:enterprise_linux:4::as |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-clientsRed Hat:enterprise_linux:4::as |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
Show 65 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openssh-debuginfoRed Hat:enterprise_linux:4::as |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-serverRed Hat:enterprise_linux:4::as |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
opensshRed Hat:enterprise_linux:4::desktop |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-askpassRed Hat:enterprise_linux:4::desktop |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-askpass-gnomeRed Hat:enterprise_linux:4::desktop |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-clientsRed Hat:enterprise_linux:4::desktop |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-serverRed Hat:enterprise_linux:4::desktop |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
opensshRed Hat:enterprise_linux:4::es |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-askpassRed Hat:enterprise_linux:4::es |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-askpass-gnomeRed Hat:enterprise_linux:4::es |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-clientsRed Hat:enterprise_linux:4::es |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-debuginfoRed Hat:enterprise_linux:4::es |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-serverRed Hat:enterprise_linux:4::es |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
opensshRed Hat:enterprise_linux:4::ws |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-askpassRed Hat:enterprise_linux:4::ws |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-askpass-gnomeRed Hat:enterprise_linux:4::ws |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-clientsRed Hat:enterprise_linux:4::ws |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
openssh-serverRed Hat:enterprise_linux:4::ws |
before 0:3.9p1-8.RHEL4.12 | 0:3.9p1-8.RHEL4.12 |
opensshRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-askpassRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-askpass-gnomeRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-clientsRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-serverRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
opensshRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-askpassRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-askpass-gnomeRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-clientsRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-serverRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
opensshRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-askpassRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-askpass-gnomeRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-clientsRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-serverRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
opensshRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-askpassRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-askpass-gnomeRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-clientsRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
openssh-serverRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:3.6.1p2-33.30.9 | 0:3.6.1p2-33.30.9 |
opensshRed Hat:enterprise_linux:2.1::as From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
openssh-askpassRed Hat:enterprise_linux:2.1::as From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
openssh-askpass-gnomeRed Hat:enterprise_linux:2.1::as From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
openssh-clientsRed Hat:enterprise_linux:2.1::as From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
openssh-serverRed Hat:enterprise_linux:2.1::as From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
opensshRed Hat:enterprise_linux:2.1::aw From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
openssh-askpassRed Hat:enterprise_linux:2.1::aw From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
openssh-askpass-gnomeRed Hat:enterprise_linux:2.1::aw From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
openssh-clientsRed Hat:enterprise_linux:2.1::aw From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
openssh-serverRed Hat:enterprise_linux:2.1::aw From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
opensshRed Hat:enterprise_linux:2.1::es From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
openssh-askpassRed Hat:enterprise_linux:2.1::es From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
openssh-askpass-gnomeRed Hat:enterprise_linux:2.1::es From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
openssh-clientsRed Hat:enterprise_linux:2.1::es From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
openssh-serverRed Hat:enterprise_linux:2.1::es From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
opensshRed Hat:enterprise_linux:2.1::ws From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
openssh-askpassRed Hat:enterprise_linux:2.1::ws From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
openssh-askpass-gnomeRed Hat:enterprise_linux:2.1::ws From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
openssh-clientsRed Hat:enterprise_linux:2.1::ws From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
openssh-serverRed Hat:enterprise_linux:2.1::ws From an advisory covering 4 CVEs |
before 0:3.1p1-21 | 0:3.1p1-21 |
opensshopenSUSE:Tumbleweed From an advisory covering 12 CVEs |
before 8.4p1-7.4 | 8.4p1-7.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-0225 is a medium vulnerability (CVSS 4.6) in Openbsd Openssh, published January 25, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in dropbear 0.48-1.
References
securityfocus.com/bid/16369
itrc.hp.com/service/cki/docDisplay.do?docId=c00815112
secunia.com/advisories/25936
vmware.com/support/vi3/doc/esx-3069097-patch.html
www14.software.ibm.com/webapp/set2/sas/f/hmc/power5/install/v52.Readme.html
Show 104 moreShow less
redhat.com/support/errata/RHSA-2006-0298.html
us-cert.gov/cas/techalerts/TA07-072A.html
trustix.org/errata/2006/0004
support.avaya.com/elmodocs2/security/ASA-2006-262.htm
osvdb.org/22692
vupen.com/english/advisories/2007/2120
lists.apple.com/archives/security-announce/2007/Mar/msg00002.html
exchange.xforce.ibmcloud.com/vulnerabilities/24305
mandriva.com/security/advisories?name=MDKSA-2006:034
securityreason.com/securityalert/462
docs.info.apple.com/article.html?artnum=305214
openpkg.org/security/OpenPKG-SA-2006.003-openssh.html
blogs.sun.com/security/entry/sun_alert_102961_security_vulnerability
novell.com/linux/security/advisories/2006_08_openssh.html
slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.425802
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1138
securitytracker.com/id?1015540
gentoo.org/security/en/glsa/glsa-200602-11.xml
bugzilla.redhat.com/bugzilla/show_bug.cgi?id=174026
sunsolve.sun.com/search/document.do?assetkey=1-26-102961-1
ubuntu.com/usn/usn-255-1
nvd.nist.gov/vuln/detail/CVE-2006-0225
github.com/advisories/GHSA-fjc8-474c-2xx3
security-tracker.debian.org/tracker/CVE-2006-0225
access.redhat.com/errata/RHSA-2006:0044
security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0044.json
cve.org/CVERecord?id=CVE-2006-0225
suse.com/security/cve/CVE-2006-0225