https://bugzilla.mindrot.org/show_bug.cgi?id=424
Anders Kaseorg <anders@kaseorg.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |anders@kaseorg.com
--- Comment #4 from Anders Kaseorg <anders@kaseorg.com> 2008-11-03 08:04:05 ---
Can someone explain why this is a protocol problem? If there’s a
client-side workaround, why isn’t the filename escaped in the scp
client?
This is a potentially nasty security problem for a trusted script that
scps files from a remote machine, because a malicious filename
containing `` could cause arbitrary code to be executed remotely.
A similar problem exists with the ssh client:
$ touch "123 456" 789; ls
123 456
789
$ ssh host touch "123 456" 789; ssh host ls
123
456
789
--
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-bugs
Anders Kaseorg <anders@kaseorg.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |anders@kaseorg.com
--- Comment #4 from Anders Kaseorg <anders@kaseorg.com> 2008-11-03 08:04:05 ---
Can someone explain why this is a protocol problem? If there’s a
client-side workaround, why isn’t the filename escaped in the scp
client?
This is a potentially nasty security problem for a trusted script that
scps files from a remote machine, because a malicious filename
containing `` could cause arbitrary code to be executed remotely.
A similar problem exists with the ssh client:
$ touch "123 456" 789; ls
123 456
789
$ ssh host touch "123 456" 789; ssh host ls
123
456
789
--
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-bugs