Bugtraq: Re: scp file transfer hole

[stanislav shalunov <shalunov () INTERNET2 EDU>]

Michal Zalewski <lcamtuf () TPI PL> writes:

> When you are scp'ing files from remote machine to your local computer,
> modified scp service on the second endpoint can spoof legitimate scp data,
> overwriting arbitrary files.
OpenSSH-1.2.1 appears to create the file wherever you tell it to, but
refuses to set setuid bit on it.

That's not quite as bad as SSH 1.2 (which will even conveniently allow
setting arbitrary file mode), but you can still overwrite
~/.ssh/authorized_keys or similar files to the same effect, as you
point you.

Very disturbing--this is supposed to be security software.

--
Stanislav Shalunov <shalunov () internet2 edu>  Internet Engineer, Internet2

A language that doesn't have everything is actually easier to program
in than some that do.                            -- Dennis M. Ritchie