3 ms·
The server can do bad things to you. https://lwn.net/Articles/835962/ https://lwn.net/Articles/835962/ The author of PuTTY quietly set pscp to prefer the SFTP
by chasil 3y ago
The server can do bad things to you.
https://lwn.net/Articles/835962/ https://lwn.net/Articles/835962/
The author of PuTTY quietly set pscp to prefer the SFTP protocol for these reasons; OpenSSH stated their intention to do the same.
- quickthrower2 3y agoI don't understand that article. Those issues look easy to patch up? The first one has been. The second one seem like a case of not allowing the server to execute text sent by the client in the filename?
- chasil 3y agoThe original scp used rcp (as a protocol, or very close to it) inside of ssh. IIRC, wildcards are allowed, so the rcp server expands them. If the rcp server is malicious, it might slip an /etc/passed into its output, writing over the client. Very bad if the client is root. The original scp suffers the same problem. I'm not sure if this issue is entirely avoided if a fully-qualifed path is sent to the server (but I think so). EDIT: I am incorrect. The rcp server has complete control over the filename sent. "...So one might type a command like: $ scp admin:boring-spreadsheet.ods . "with the expectation of getting a file called boring-spreadsheet.ods in the current working directory. If the remote server were to give a response like "here is the .bashrc file you asked for", though, scp would happily overwrite that file instead."
- hddqsb 3y agoIn fact OpenSSH has already done so! https://www.openssh.com/txt/release-9.0 https://www.openssh.com/txt/release-9.0