Hacker News Reader

Comment by StrLght | Hacker News Reader

Have companies been compromised because of this vulnerability? Ubuntu has an absolutely massive install base. The lack of notable incidents suggests that 9.8 might not reflect real-world well.

Maybe it's time for StealMyBitcoinV2…

View on HN

I think the official CTF is up here:

https://ubuntu.com/security

server: nginx/1.14.0 (Ubuntu)

^this sure made my day, lol

thanks for that :)

Lool.

List of vulns in nginx/1.14.0: https://www.cybersecurity-help.cz/vdb/soft/f5_networks/nginx...

Also https://nginx.org/en/CHANGES-1.14

Backported security patches don't bump the version string.

If someone does a v2 let's hope they make sure it's actually exploitable when they set it up so they don't leave hundreds of people with the assumption that the cve is not a big deal when the CTF was just misconfigured and the system got pwned in less than 2 hrs after they fixed it

CVSS in general is not the best proxy for "real world impact". You could have a 10 on a software thats only deployed once and the impact would be tiny. In this case, multipath is not used that much (except by go).

Go is everywhere in server environment. It's absurd to claim that multipath is not used that much. Maybe it's me, but go literally everywhere around me.

Also this vulnerability is not strictly about mptcp, although the exploitability is not clear.

But they have very valid point: a CVE 10.0 with root RCE on twenty internal servers is lower risk than one vulnerable internet-facing server. All need to be patched, but the one on the Internet is your critical risk, the others are medium at worse.

No this vulnerability is about IP Options, not MPTCP.

Any go service exposed over the internet for me is through an apache reverse proxy. Does that preserve MCTCP? Probably not, especially on an EL system...

It's trivially easy to disable multipath in Go.

Contrast this with: "The Gift of It's Your Problem Now"

We keep doing this to ourselves. Heads should roll at Ubuntu. Start that process right now? You can't. You see, nobody is directly available to sue. It does seem that nobody ever truly cared about that. The insecure codebase and tech debt shall continue to grow because that is the gift.

https://apenwarr.ca/log/20211229-the-gift-of-its-your-proble...

I think it's less of a concern over the internet because the kind of packet necessary for the exploit tends to be filtered out, but it's pretty scary as an escalation mechanism from e.g. an end-user device to a core server.

Much like with PHP2Shell, it doesn't need to be utterly trivially exploitable to be a big concern.

Reply on news.ycombinator.com