News for hackers. Stuff that matters.

A comment on Multiple CRLF injection vulnerabilities in session.c in OpenSSH before 7.2p2.

Re:Multiple CRLF injection vulnerabilities in session.c in O... by cat-dev-null on Wednesday March 23, 2016 @02:48PM (#11347148)
Not a huge deal since X11Forwarding is usually disabled by default.

It is another reason for best practices of just-enough infrastructure -> smaller attack surface: disable unused features and ship server daemons with sane defaults with minimal features enabled.

[ Parent | on HN ]
Re:Multiple CRLF injection vulnerabilities in session.c in O... by anjbe on Wednesday March 23, 2016 @03:33PM (#11347507)
> Not a huge deal since X11Forwarding is usually disabled by default.

Except on Red Hat… https://threatpost.com/openssh-implementations-with-x11forwa...

[ Parent | on HN ]