Hacker News Reader

Comment by tptacek | Hacker News Reader

This looks more or less like the same bug that hit nginx (perhaps unsurprisingly? doesn't Node borrow nginx's HTTP parsing code?).

It's a bad bug; if you haven't updated nginx to get the patch, you should do it. The public writeups don't do it justice.

View on HN

The public writeups have strongly implied that if I use nginx as a proxy and own all the backend servers, nothing "bad" will happen to me. Is that not the case? (I just want to understand the bug, not debate whether upgrading is the right thing.)

That's not the case at all. You can ping me privately if there's some reason you can't just patch nginx; at this point, though, you should just patch and be done with it.

Already patched. But if you could provide details (a link?) about how else one would create "specially crafted backend responses", I'd love to know more. How does an attacker make my nginx talk to their remote server (or trick my remote server into providing a specially crafted response)?

There's not a whole lot of commentary that I've found, but for instance, take these guys. "In order to exploit this vulnerability, the attacker has to be located on both sides of nginx (configured as proxy)." (http://vigilance.fr/vulnerability/nginx-memory-reading-via-c...) That about sums up my understanding as well. If that is not true, then I think the nature of the bug has been seriously misrepresented.

No, it's nowhere nearly that complicated to exploit.

With approximately five minutes of conversation with Thomas I was able to write a ~30 line Ruby script which successfully compromised $A_THING_OF_IMMENSE_VALUE on a Rails app (my own, in staging) over the public Internet in a matter of seconds using no insider knowledge of that app's architecture.

Thomas is being oblique with regards to the implications of this for a reason.

Thanks. Good enough for me.

node.js doesn't share any code with nginx

That's not quite true. The http-parser library has some bits lifted from nginx. Node itself, however, does not, and the bug is not quite the same as the nginx bug (though they do have a lot of words in common: attacker, request, carefully-crafted, etc. ;P

The impact of the bug is the same, and it's an idiosyncratic kind of memory corruption bug, which is why I thought the original flaw might have been inherited. Thanks for clearing it up.

s/corruption/information leak

To my mind the exact same class of bugs, but you're not wrong to clarify. It's a particularly bad breed of "disclosure".

Ah I see. Thanks I missed it there in the /deps directory, I just followed the link to a node C++ file in the commit in question.

Nginx and Node have totally separate http parsers, may be Node uses some code( like https://github.com/joyent/libuv/blob/master/include/uv-priva...) but nothing related to this issue.

Reply on news.ycombinator.com