bugzilla-daemon at bugzilla
Oct 22, 2009, 6:19 PM
Post #1 of 1
(143 views)
Permalink
|
|
[Bug 1606] internal-sftp does not drop conections properly, it will hang
|
|
https://bugzilla.mindrot.org/show_bug.cgi?id=1606
Damien Miller <djm[at]mindrot.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #1648|0 |1
is obsolete| |
--- Comment #2 from Damien Miller <djm[at]mindrot.org> 2009-10-23 12:19:31 EST ---
Created an attachment (id=1704)
--> (https://bugzilla.mindrot.org/attachment.cgi?id=1704)
abort non-subsystem sessions to forced internal sftp-server
I think your proposed fix introduces a security vulnerability - a user
could upload a file "internal-sftp" and sshd would execute it, since
the SUBSYSTEM_INT_SFTP is no longer set when processing the session.
--
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs[at]mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-bugs
|
