News for hackers. Stuff that matters.

A comment on 35-year-old vulnerability discovered in scp. Parent comment

Re:35-year-old vulnerability discovered in scp by reacweb on Tuesday January 15, 2019 @03:28AM (#18909603)
I accept incorrect host keys a couple of time per year because the IT has changed an IP adress or when a server is replaced. I do not always bother to check that I have a mail notifying me that the change was planned. Knowing this new vulnerability, I will take care to not perform a scp toward my home directory and I will double check PATH when logging to a new account (check that PATH does not contain "." before /usr/bin and /bin). IMHO, this is a major vulnerability for unix users.
[ Parent | on HN ]
Re:35-year-old vulnerability discovered in scp by walrus01 on Tuesday January 15, 2019 @03:31AM (#18909621)
The risk mitigation part here is that you know in advance a server has moved before you try to SSH to it. The real risk is less than cautious people who might choose 'yes' to accept a new host key when sshing towards a sshd that they have no prior knowledge of having changed IPs, or having been re-imaged, etc.
[ Parent | on HN ]
Re:35-year-old vulnerability discovered in scp by jedberg on Tuesday January 15, 2019 @03:33AM (#18909638)
Unix has usually been pretty good about giving you plenty of rope to hang yourself. :) Tools don’t usually protect from their own misuse — in this case not verifying a changed host key.
[ Parent | on HN ]