News for hackers. Stuff that matters.

A comment on Rsync client-side arbitrary file write vulnerability. Parent comment

Re:Rsync client-side arbitrary file write vulnerability by blueflow on Tuesday August 02, 2022 @04:04PM (#32323601)
It does since recently, check the -O option in the manpage.
[ Parent | on HN ]
Re:Rsync client-side arbitrary file write vulnerability by water8 on Wednesday August 03, 2022 @03:26PM (#32335799)
No it doesn’t SCP has no support for directory listing. The -o flag only controls the security layer which is openSSL just like SFTP. So you established the S’s are the same, But the P’s (protocol) are different. A protocol is like get post put… Totally separate from security
[ Parent | on HN ]
Re:Rsync client-side arbitrary file write vulnerability by blueflow on Thursday August 04, 2022 @05:24AM (#32340866)
https://www.openssh.com/txt/release-9.0 :

> This release switches scp(1) from using the legacy scp/rcp protocol to using the SFTP protocol by default.

From the scp(1) manpage:

> -O: Use the original SCP protocol for file transfers instead of the SFTP protocol. Forcing the use of the SCP protocol may be necessary for servers that do not implement SFTP, for backwards-compatibility for particular filename wildcard patterns and for expanding paths with a ‘~’ prefix for older SFTP servers. This mode is the default.

[ Parent | on HN ]