38

Unauthenticated RCE vs all GNU/Linux systems to be fully disclosed in 2 weeks with no working fix yet(nitter.poast.org)

posted
*
by
Avatar
Treasure@feddit.org
in
Avatar
cybersecurity@sh.itjust.works
19 comments
hidereport

EDIT: Original post seems to have been removed, try this Nitter mirror instead.

Sort:
HotTopControversialNewOld
Avatar
englislanguage@lemmy.sdf.org
2 points

If this is true (or at least plausible to the relevant people), the author of that Twitter post will probably be on the radar of any shady government agency worldwide. Not a nice situation to be in.

permalink
report
reply
Avatar
kbal@fedia.io
14 points

Okay, who’s giving odds on this one coming anywhere close to living up to its billing?

permalink
report
reply
Avatar
CameronDev@programming.dev
9 points

The claims are well into the “I found a unicorn” territory, I’m tipping its either “If you misconfigure this, its unsafe”, or its a real vuln, and its significantly harder to exploit that they are claiming.

permalink
report
parent
reply
Avatar
bigkahuna1986@lemmy.ml
10 points

Unauthenticed RCE vs all GNU/Linux systems

So this would probably be SSH related right? Otherwise what would all Linux systems have in common?

permalink
report
reply
Avatar
CameronDev@programming.dev
5 points

Not all Linux’s have SSH enabled, especially out of the box.

They have some other posts about IPv6 parsing (also not universal), but that doesnt sound like an “easy” RCE.

permalink
report
parent
reply
Avatar
m-p{3}@lemmy.ca
15 points

My bet is on Systemd.

permalink
report
parent
reply
Avatar
thesmokingman@programming.dev
5 points

That’s not all GNU/Linux though. Either the OP doesn’t understand a very common container OS, Alpine, doesn’t use systemd (also Void Linux and others outside the container space) or it’s something else.

permalink
report
parent
reply
Avatar
Luci@lemmy.ca
3 points

Oh that would be baaaad

permalink
report
parent
reply
Avatar
BoofStroke@sh.itjust.works
4 points

And unsurprising

permalink
report
parent
reply
Show more comments
Avatar
schizo@forum.uncomfortable.business
4 points

If it were SSH though, wouldn’t that ALSO include a wider blast radius than just Linux systems?

Like OpenSSH is used all over the damn place, unless I guess there’s something specific about the issue that limits it to Linux hosts for some reason?

permalink
report
parent
reply
Avatar
SpaceMan9000@lemmy.world
2 points

He claims the blast radius is bigger, not just Linux. He also claims to be in talks with Apple. So the educated guess would still be openssh

permalink
report
parent
reply
Avatar
superkret@feddit.org
8 points
*

It supposedly affects all GNU/Linux systems, there’s no fix, existed for 10 years, severity of 9.9, but there’s an “easy workaround”.
I’m curious.

permalink
report
reply
Avatar
Nougat@fedia.io
11 points

easy workaround

Turn the power off?

permalink
report
parent
reply
Avatar
Bakkoda@sh.itjust.works
1 point

Rj45 to 110v adapter is more funnerer.

permalink
report
parent
reply
Avatar
Treasure@feddit.orgOP
8 points

Me too, I’m looking forward to the writeup.

permalink
report
parent
reply

Cybersecurity

!cybersecurity@sh.itjust.works

Create post

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

  • Be respectful. Everyone should feel welcome here.
  • No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
  • No Ads / Spamming.
  • No pornography.

Community Rules

  • Idk, keep it semi-professional?
  • Nothing illegal. We’re all ethical here.
  • Rules will be added/redefined as necessary.

If you ask someone to hack your “friends” socials you’re just going to get banned so don’t do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !cybersecurity@lemmy.capebreton.social !securitynews@infosec.pub !netsec@links.hackliberty.org !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

Community stats

  • 1.6K

    Monthly active users

  • 894

    Posts

  • 1.8K

    Comments

Community moderators