3 ms·

> Due to accepting and displaying arbitrary stderr output from the scp server, a malicious server can manipulate the client output, for example to employ ANSI c

• freiheit 8y ago
  Your client asks for 1 file, the server comes back with 2 files (the 2nd one what you actually asked for), but the name of the first (tiny) file's name contains escape sequences that clear the line, move up a line, or otherwise obscure that the first file was sent.
  • teacpde 8y ago
    Awesome, found https://en.wikipedia.org/wiki/ANSI_escape_code https://en.wikipedia.org/wiki/ANSI_escape_code and played a bit in my terminal. It is fun. $ echo -e "hello\n\e[1A[2K\rworld" $ world
• syn0byte 8y ago
  #!/bin/bash echo "Magic!" echo -en "\033[1F\033[2K" echo "Moar Magic!" This script will print "Magic!" then the next echo sends escape sequences that move the cursor up 1 line with '\033[1F', then '\033[2K' clears the line the cursor is on, which is now the "Magic!" line. Then we output "Moar Magic". 3 commands but only one line of output. The -e option on echo enables the escape sequences instead of literal chars. -n disables echos automatic newline for the sequence that deletes the first line scp servers can of course do all the same trickery.