and here I thought "4" was the worst someone was going to screw up internet security this year
1 Boost
0 Likes
@foone What I find amazing is that I had to read the description of the problem three times before I understood what was broken.
I know it's only with musl and no PAM but I have shipped multiple embedded systems that match that description
no one should hook up a USB to ethernet adapter to anything I've ever worked on and trying logging into root with a long-ass password.
@foone Lots of embedded *gifts* for quite a while on this one.
@foone presumably you didn't have root login allowed with password auth though right??
@confusionunknown no, root login was disabled, but another account did have a password. which is exactly the case where this vulnerability applies
@foone I read openwrt was affected, but on my gl-inet Beryl AX it won’t work.
@foone Password-auth required, and openssh required. I think all the systems I have deployed using musl use dropbear.
@foone it was discovered by an LLM sitting on the keyboard.
@foone Because everyone turns off password authentication since it's annoying & not as secure as a key no matter what you do.
@foone has anybody actually verified this yet?
@foone maybe every cat owner just disables password authentication immediately.
@foone nothing, or more than 256, is both less, and more, than "4". So, there is going to be a "1 fail", a "2" one, a "3" one, and so on, isn't there?
@foone I'm not sure "4" was even the worst screwup on that day, but it was (and IMO remains) by far the most memeable
this bug has existed for 10 years?
how was it not discovered by a cat sitting on a keyboard?