OpenPKG Security Advisory – Ulrich Drepper discovered [0] a weakness in OpenSSH [1] version 4.2p1 and earlier, caused due to the insecure use of the system(3) function in scp(1) when performing copy operations using filenames that are supplied by the user from the command line. This can be exploited to execute shell commands with privileges of the user running scp(1).
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/43999/OpenPKG-SA-2006.003.txt
Source: https://packetstormsecurity.com/files/43999/OpenPKG-Security-Advisory-2006.3.html