and here I thought "4" was the worst someone was going to screw up internet security this year
1 Boost
0 Likes
this bug has existed for 10 years?
how was it not discovered by a cat sitting on a keyboard?
@foone What I find amazing is that I had to read the description of the problem three times before I understood what was broken.
I know it's only with musl and no PAM but I have shipped multiple embedded systems that match that description
no one should hook up a USB to ethernet adapter to anything I've ever worked on and trying logging into root with a long-ass password.
@foone Lots of embedded *gifts* for quite a while on this one.
@foone presumably you didn't have root login allowed with password auth though right??
@confusionunknown no, root login was disabled, but another account did have a password. which is exactly the case where this vulnerability applies
@foone I read openwrt was affected, but on my gl-inet Beryl AX it won’t work.
@foone Password-auth required, and openssh required. I think all the systems I have deployed using musl use dropbear.
@foone it was discovered by an LLM sitting on the keyboard.
@foone Because everyone turns off password authentication since it's annoying & not as secure as a key no matter what you do.
@foone has anybody actually verified this yet?
@foone maybe every cat owner just disables password authentication immediately.
@foone nothing, or more than 256, is both less, and more, than "4". So, there is going to be a "1 fail", a "2" one, a "3" one, and so on, isn't there?
@foone I'm not sure "4" was even the worst screwup on that day, but it was (and IMO remains) by far the most memeable
@foone European supermarket chains throwing out food _twice_ because of having their fridges exposed to the open internet are a strong contender.
They either had long known vulnerabilities or were using simple passwords like the current date or 12345.