3 ms·
I can’t parse the exact meaning of the ”victim system” and ”attacker controlled system” in the OpenSSH release page. Does this vulnerability allow the attacker
by shandor 3y ago
I can’t parse the exact meaning of the ”victim system” and ”attacker controlled system” in the OpenSSH release page.
Does this vulnerability allow the attacker to compromise the original system where the user starts the agent-forwarded connection? Or ”only” compromise machines forward from the jump host?
http://www.openssh.com/releasenotes.html#9.3p2 http://www.openssh.com/releasenotes.html#9.3p2
- perlgeek 3y agoIf an attacker can compromise the jump host, they can compromise the system where the user starts the agent-forwarded connection.
- shandor 3y agoOuch, that’s horrible. Time to prompt everyone at $WORK to upgrade…
- Arnavion 3y agoTo be clear, agent-forwarding to a (potentially) malicious ssh server has always been a bad idea. Yes TFA's bug makes it a worse idea and it's absolutely worth it to patch it, but you should not be agent-forwarding to (potentially) malicious ssh servers in the first place.
- gunapologist99 3y agoThat's 100% correct. This is why no one should use agent forwarding with a jumpbox. Only -J. (see https://userify.com/docs/jumpbox https://userify.com/docs/jumpbox ) Another point is that no one should have any real access to the jumpbox and it should be as minimal and stripped-down as possible. It's literally your bastion host, so you've got to keep it as strong as possible.