Secunia has released an advisory here that addresses an issue with the use of the "system()" function in scp. Because of this usage, certain special characters, that may be in the command line arguments to scp that are escaped on the command line, go through shell expansion twice and lose their special escape character. This can cause what was initially a valid filename to now be interpreted as multiple filenames (pointing to non-existing files) or as additional commands (if the filename had included a semi-colon).
Additional details about the bug can be found from this Bugzilla post.
The latest version of OpenSSH, 4.2p1, is affected by this issue and a patch has not yet been made generally available. Fedora has released updated RPMs for Fedora Core 4 that address this issue. You can get more information about the Fedora updates here.
Here is an example from the Bugzilla post demonstrating the bug
Steps to Reproduce:
Jan 24th 2006
1 decade ago