Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
1–10 of 322 posts
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#2I... do they know about -A? Someone should tell them.
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#3I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#4I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.
Eh? Software can do exactly that.
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#5Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#6Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#7Source says they also did some input sanitizing along with blocking curl, and they had to make a new PoC to get around that. If I'm reading that right then this isn't really an issue, nothing wrong with defense in depth.
Edit:
>The update adds several filters to handle single quotes in user input. However, these filters can be evaded by specially crafted inputs. By providing the following string for the certificate's common name, a "ping" command can be injected:
Title is misleading, implying the only patch was blacklisting curl.
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#8Of all the security post-mortems I’ve ever wanted to read, it’s sad I’ll probably never get to read this one and its tale of how a team of well-paid comfortable engineers got together and decided this patch was a good idea.
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#9I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.
Eh? Software can do exactly that.
How? Do you think developers would be so crazy as to add some sort of "--user-agent" option to software like curl that would cause arbitrary strings to be presented as the user agent? Why would somebody write software to do this, just go on the internet and tell lies?
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#10I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.
I guess the biggest problem is that the mitigation isn't future-proof. Someday, there might be other command-line tools besides cURL that can be used for this kind of attack.
A better fix would be to just drop all incoming IPv4 packets that have the "evil" bit set. (https://www.ietf.org/rfc/rfc3514.txt) Extending this protection to IPv6 is left as an exercise for the reader.