News for hackers. Stuff that matters.

A comment on OpenSSH: client bug CVE-2016-0777. Parent comment

Re:OpenSSH: client bug CVE-2016-0777 by semi-extrinsic on Thursday January 14, 2016 @01:02PM (#10903078)
Does anyone know how this interacts with ProxyCommand? If I fix this in ~/.ssh/config on my laptop, and I ssh to hostB through hostA using

  Host hostB
    ...
    ProxyCommand ssh hostA -W %h:%p
in the config on my laptop, do I also need to fix it on hostA?
[ Parent | on HN ]
Re:OpenSSH: client bug CVE-2016-0777 by aexaey on Thursday January 14, 2016 @01:07PM (#10903116)
CVE-2016-0777 doesn't interact with ProxyCommand in any special way. That said, after connecting to hostB with your example config above you will have 2 ssh sessions:

1) from your client to hostA

2) from your client to hostB

So to answer your question - no, vulnerable client on hostA is not a problem (or at least not in this particular use-case).

[ Parent | on HN ]
Re:OpenSSH: client bug CVE-2016-0777 by semi-extrinsic on Thursday January 14, 2016 @01:14PM (#10903182)
> Vulnerable client on hostA is not a problem.

Ok, that's what I was wondering. Thanks.

[ Parent | on HN ]