- cross-posted to:
- privacy@lemmy.ml
EDIT: Original post seems to have been removed, try this Nitter mirror instead.
- Karna ( @KarnaSubarna@lemmy.ml ) 3•7 hours ago
More important question is - how this nitter instance is still working!!
- doubtingtammy ( @doubtingtammy@lemmy.ml ) 2•7 hours ago
Gotta wonder how many state actors have been using it for years.
- Laser ( @Laser@feddit.org ) 10•18 hours ago
Since this affects Linux and others, I’m guessing this is about OpenSSH. But I’m not very certain. Just can’t think of another candidate.
But holy sh, if your software has been running on everything for the last 20 years
This doesn’t sound like glibc as someone in the thread guessed.
- Strit ( @Strit@lemmy.linuxuserspace.show ) 4•18 hours ago
Could be quite a few different things.
Could be the kernel itself, gnupg, openSSH or even bash.
But we won’t know for sure, until it’s publically disclosed.
- Laser ( @Laser@feddit.org ) 5•17 hours ago
Could be the kernel itself
Wouldn’t make sense to me because the thread says GNU/Linux and others, though this could relate to Android or distros not using any GNU.
gnupg
Usually not exposed to the network though, but it’s generally a mess so wouldn’t be too surprising
Another candidate I have in mind is ntpd, but again that is usually not easily accessible from outside and not used everywhere, as stuff like systemd-timesyncd exists.
Just want to stress that I’m not sure about it being OpenSSH, it was more supposed to be a fun guess than a certain prediction
- gomp ( @gomp@lemmy.ml ) 6•17 hours ago
I guess I’ll worry about this in 2 weeks then
- narc0tic_bird ( @narc0tic_bird@lemm.ee ) 30•1 day ago
Let’s see if this really affects all Linux systems or if the stars need to align for this to actually be exploitable.
- Possibly linux ( @possiblylinux127@lemmy.zip ) English6•15 hours ago
A 9.9 is pretty bad no matter what. They wouldn’t rank it almost a 10 if it was some obscure bug that is very hard to exploit.
With that being said it is hard to know without details
- ShortN0te ( @ShortN0te@lemmy.ml ) 9•20 hours ago
I agree, all this attention grabbing sound to me as if this is actually not a big deal. But we will see i guess.
- notfromhere ( @notfromhere@lemmy.ml ) 11•1 day ago
Nitter link not working. What’s the jist?
This link should be working.
Quoting from the OP tweet:
* Unauthenticated RCE vs all GNU/Linux systems (plus others) disclosed 3 weeks ago.
* Full disclosure happening in less than 2 weeks (as agreed with devs).
* Still no CVE assigned (there should be at least 3, possibly 4, ideally 6).
* Still no working fix.
* Canonical, RedHat and others have confirmed the severity, a 9.9, check screenshot.
* Devs are still arguing about whether or not some of the issues have a security impact.I’ve spent the last 3 weeks of my sabbatical working full time on this research, reporting, coordination and so on with the sole purpose of helping and pretty much only got patronized because the devs just can’t accept that their code is crap - responsible disclosure: no more.
- Lemmchen ( @Lemmchen@feddit.org ) 4•15 hours ago
A 9.9!? Holy shit.
- Possibly linux ( @possiblylinux127@lemmy.zip ) English5•15 hours ago
The real question what is the exploitability score
- caseyweederman ( @caseyweederman@lemmy.ca ) 1•5 hours ago
I’ve noticed Canonical replaced their score breakdown with an ad for their paid services.
- Possibly linux ( @possiblylinux127@lemmy.zip ) English2•5 hours ago
That probably means this is closer to a publicity stunt. I’ll just wait until there is more information.
- caseyweederman ( @caseyweederman@lemmy.ca ) 1•5 hours ago
No, I mean for every USN
- LiveLM ( @LiveLM@lemmy.zip ) English6•18 hours ago
Seems like he not only deleted the Tweet but also protected his whole account… Very weird…