But how could it use this to for code execution on the local machine?
By the remote attacker sending whatever of
https://invisible-island.net/xterm/ctlseqs/ctlseqs.html
is most inconvenient for you, the user on the client?
Well, the only solution for that is to have a client that filters
the incoming control sequences (tmux was already mentioned?!).
Or use a remote terminal - like with mosh, which has a screen
on the remote side and only transfers the characters and colors -
so no local keyboard redefinitions, window title changes, etc.
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@xxxxxxxxxxx
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
