CVE-2019-7282

What it actually does

The rcp client accepts filenames of '.' or the empty string from a remote rsh server and performs a chmod operation on the target directory, bypassing the intended restriction that only explicitly named files may have their permissions changed.

Why it matters to the business

Attackers who control an rsh server can silently alter directory permissions on client systems that still invoke the legacy rcp command, potentially enabling unauthorized access or disruption of file operations on systems that have not removed or replaced NetKit utilities.

How an attack unfolds

An attacker hosts a malicious rsh server that responds to an rcp request with a crafted filename of '.' or the empty string; when the client performs the requested permission change, the target directory on the client has its mode altered without the user's knowledge or consent.

How to fix it

Remove or replace the NetKit rcp client with a modern, maintained implementation such as OpenSSH scp or rsync; where removal is not feasible, restrict use of rcp to trusted servers only and monitor for invocations of the legacy binary.

How to confirm the fix worked

Confirm that the rcp binary is no longer present or is replaced by a non-vulnerable implementation; test by attempting an rcp transfer against a controlled server that returns '.' and verify that no chmod occurs on the target directory.

Typical attack path

1. Attacker positions a controlled rsh server reachable by the victim client
2. Victim initiates an rcp transfer that contacts the attacker's server
3. Server returns a filename of '.' or the empty string in the protocol response
4. Client performs chmod on the resulting target directory
5. Directory permissions are modified, enabling subsequent unauthorized access

How to detect it

Search process execution logs and command-line audit trails for invocations of the rcp binary; inspect file-system permission change events on directories that coincide with rcp activity; review network connections to non-standard rsh ports around the time of permission modifications.

• rcp
• /usr/bin/rcp
• rsh.*rcp
• chmod.*\.$

What your security team should do

• Inventory all systems still shipping or using NetKit utilities and schedule their decommissioning or replacement
• Block or heavily restrict outbound rsh/rcp traffic at network boundaries
• Add rcp execution to EDR and SIEM alerting rules for legacy binary usage
• Prefer modern SSH-based file transfer tools in all new deployments and scripts