https://bugzilla.mindrot.org/show_bug.cgi?id=3693
--- Comment #2 from renmingshuai <rmsh1...@163.com> --- (In reply to Damien Miller from comment #1) > No, it's not based on the protocol because it's local only. > > How could a server exploit this? There's no way for sftp to pass > server output to its command input unless the user explicitly > configures it. It is not sftp that passes the server output to its command input. The user's expect script captures the keyword "password" in the server's banner, and then input "!test" to sftp command input. For example: spawn sftp username@Host expect { "*assword*" {send --"! test\r"} } -- You are receiving this mail because: You are watching the assignee of the bug. You are watching someone on the CC list of the bug. _______________________________________________ openssh-bugs mailing list openssh-bugs@mindrot.org https://lists.mindrot.org/mailman/listinfo/openssh-bugs