CVE-2019-25017

CVE-2019-25017 describes a medium-severity vulnerability in the rcp client within MIT krb5-appl through version 1.0.3, where a malicious rcp server or Man-in-The-Middle attacker can overwrite arbitrary files in the client's target directory, including sensitive files like .ssh/authorized_keys during recursive operations. The attack requires high attack complexity, but no user interaction. There is no evidence of active exploitation, public exploit code, or significant community discussion, and the affected code was removed from supported MIT Kerberos 5 years ago.