An ssh server would exploit a vulnerability in the ssh client when it connects.
For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh.
To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.
3dedb728-3f77 · · focus · HN ↗
People understand that reverse hacking can happen when connecting to random ssh server, right?
scubbo · · focus · HN ↗
No, actually, I've never heard of such a vector. How would that work?
jerrythegerbil · · focus · HN ↗
For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh.
To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.
pydry · · focus · HN ↗
has there ever been an example of such a vulnerability in openssh?