Bug#796314: openssh: copying special crafted filenames executes shell-command
On Fri, Aug 21, 2015 at 11:35:08AM +0200, bgrpt3@toplitzer.net wrote:
> According to [1] special crafted filenames containing control characters
> can cause scp to execute commands in the current shell.
For clarity, that's not what the upstream bug report says. This is
*not* a matter of scp executing commands in the current shell, but
rather a matter of scp sending escape sequences to the terminal; quite a
different thing. That is, "tput clear" emits an escape sequence which
causes the terminal to clear the screen, and when scp prints the file
name it reproduces that escape sequence and thereby clears the screen.
--
Colin Watson [cjwatson@debian.org]
Reply to: