[Bug 1025418] Re: Using ProxyCommand w/a non-existant host results in infinite spawns.

[Jordon Bedwell]

@racb Setting aside the fact that you think I don't know how to
configure a server or prevent it, the faulty logic is that "because you
can fork bomb already this problem doesn't matter and it's not worth it"
yeah? I don't know if that's funny or what...

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/1025418

Title:
  Using ProxyCommand w/a non-existant host results in infinite spawns.

Status in “openssh” package in Ubuntu:
  Invalid

Bug description:
  Version: OpenSSH_5.9p1 Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012
  Package: openssh-client

  Today we discovered a possible bug in the OpenSSH-Client package
  (openssh) that happens when you enable ProxyCommand with a non-
  existant hostname.  This bug is easily replicated with the default
  example in /etc/ssh/ssh_config.  If one uncomments that line and then
  for example tries to push via Git SSH you end up with SSH spawning
  over and over and over again as seein the attached screenshot.

  I have flagged this as a security bug (but ultimately it's up to ya'll
  if it is) because any user can do this and take down any server quite
  easily by adding add a bad ProxyCommand to their ~/.ssh/config.  I was
  able to take out one of my personal servers (which happens to be a
  pretty big server) within a few minutes.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1025418/+subscriptions