https://bugzilla.mindrot.org/show_bug.cgi?id=1606
Damien Miller <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #1648|0 |1 is obsolete| | --- Comment #2 from Damien Miller <[email protected]> 2009-10-23 12:19:31 EST --- Created an attachment (id=1704) --> (https://bugzilla.mindrot.org/attachment.cgi?id=1704) abort non-subsystem sessions to forced internal sftp-server I think your proposed fix introduces a security vulnerability - a user could upload a file "internal-sftp" and sshd would execute it, since the SUBSYSTEM_INT_SFTP is no longer set when processing the session. -- Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching the assignee of the bug. You are watching someone on the CC list of the bug. _______________________________________________ openssh-bugs mailing list [email protected] https://lists.mindrot.org/mailman/listinfo/openssh-bugs
