Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: OpenSSH: Bugs

[Bug 1998] New: Arbitrary command execution using SCP

 

 

OpenSSH bugs RSS feed   Index | Next | Previous | View Threaded


bugzilla-daemon at bugzilla

Apr 17, 2012, 2:12 PM

Post #1 of 1 (144 views)
Permalink
[Bug 1998] New: Arbitrary command execution using SCP

https://bugzilla.mindrot.org/show_bug.cgi?id=1998

Bug #: 1998
Summary: Arbitrary command execution using SCP
Classification: Unclassified
Product: Portable OpenSSH
Version: 5.8p1
Platform: All
OS/Version: Linux
Status: NEW
Severity: security
Priority: P2
Component: scp
AssignedTo: unassigned-bugs [at] mindrot
ReportedBy: vitja.makarov [at] gmail


Hi!

I'm not sure is that a bug or a future. Since SCP doesn't escape
filenames it's possible to execute an arbitrary command:

localhost:~$ scp 'mchome:foo;echo 123 > foo' /tmp/foo
scp: foo: No such file or directory
localhost:~$ scp 'mchome:foo;echo 123 > foo' /tmp/foo
foo
100% 4 0.0KB/s 00:00
localhost:~$ cat /tmp/foo
123


I've traced it and it seems to me that scp is executing the following
command on remote side:

scp -f -- foo;echo 123 > foo

--
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs [at] mindrot
https://lists.mindrot.org/mailman/listinfo/openssh-bugs

OpenSSH bugs RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.