35-year-old vulnerability discovered in scp

Re:35-year-old vulnerability discovered in scp by jedberg on Tuesday January 15, 2019 @03:29AM (#18909608)

I see so in the case that I scp from an untrusted host, I could have added risk that it is silently overwriting filed in my local home dir.

That makes sense I suppose. I never scp files from untrusted hosts, nor can I think of a use case to do so, so it hadn’t really crossed my mind.

[ Parent | on HN ]

Re:35-year-old vulnerability discovered in scp by ajdlinux on Tuesday January 15, 2019 @03:42AM (#18909687)

There are plenty of use cases where the host you're connecting to isn't completely untrusted but rather it's semi-trusted. Web hosting provider, university machine, etc - all multi-tenant environments which have a tendency to get compromised.

[ Parent | on HN ]

Re:35-year-old vulnerability discovered in scp by willvarfar on Tuesday January 15, 2019 @03:40AM (#18909672)

You should not trust the server. The server may have been compromised.

[ Parent | on HN ]

Re:35-year-old vulnerability discovered in scp by pbhjpbhj on Tuesday January 15, 2019 @07:52AM (#18910780)

The client may have also been compromised, you may have, you might be in the Truman show ... /s

If I'm reading the OP right, whilst directory permissions can be modified, traversal is not possible, so it can't overwrite outside the directory you're writing to. But if you wrote to your home directly then your .bashrc could be modified ... and it sounds like other vulnerabilities allow the actual processing to be hidden (spoofed console output).

Seems like the sort of thing that could be used in a spear-fishing scenario.

I wonder if you could write a StackExchange answer with instructions to scp files from such-and-such server ...

[ Parent | on HN ]