search for: process_put

...", g.gl_pathv[i], abs_dst); +#ifdef REGET + if (do_download(conn, g.gl_pathv[i], abs_dst, pflag, rflag) == -1) +#else if (do_download(conn, g.gl_pathv[i], abs_dst, pflag) == -1) +#endif err = -1; xfree(abs_dst); abs_dst = NULL; @@ -497,7 +520,11 @@ } static int +#ifdef REGET +process_put(struct sftp_conn *conn, char *src, char *dst, char *pwd, int pflag, int rflag) +#else process_put(struct sftp_conn *conn, char *src, char *dst, char *pwd, int pflag) +#endif { char *tmp_dst = NULL; char *abs_dst = NULL; @@ -557,7 +584,11 @@ abs_dst = make_absolute(tmp, pwd); printf(&...

Hi folks. We were made aware of a MITRE CVE assignment on OpenSSH for a remote DoS in sftp, described as: The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by g...

...Status|NEW |ASSIGNED AssignedTo|bitbucket at mindrot.org |djm at mindrot.org --- Comment #1 from Damien Miller <djm at mindrot.org> 2008-01-20 11:31:11 --- Created an attachment (id=1445) --> (http://bugzilla.mindrot.org/attachment.cgi?id=1445) process_put: check pathname even if glob does not match The recently committed argument parser changes together with this additional patch make all your test cases pass: sftp> put '[eztv]' Uploading [eztv] to /tmp/xxxx/[eztv] [eztv] 100% 0 0.0KB/s 00...

...of a non-existent file is given as the argument to a 'get' or 'put' command, sftp(1) fails to interpret correctly the result of the glob(3) invocation. glob(3) does not return an error (a non-zero exit), yet it does not return any meaningful file names, either, so process_get() and process_put()'s attempts to access the gl_pathv[] array fail miserably. A trivial patch is posted in the audit-trail of the FreeBSD problem report referenced by the URL above. ------- You are receiving this mail because: ------- You are the assignee for the bug, or are watching the assignee.

Hello all Im using sftp 1:4.7p1-8ubuntu1.2 in a batchjob Ive noticed that sftp needs a long time for sending a filelist. The timespan increases exponential if many files are on the remoteserver. for example "ls -la *.txt" needs 10 seconds for 2000 files but needs 50 seconds for 4000 files. For 150.000 Files i have to wait 15 minutes for example but the

Hi, The 4.4p1 release is approaching now, so we are now asking people to actively test snapshots or CVS and report back to the mailing list. Snapshots are available from http://www.mindrot.org/openssh_snap or from any of the mirrors listed on http://www.openssh.org/portable.html The latter page also includes instructions for checking out portable OpenSSH via anonymous CVS. This release