Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

twitter.com

Post reply on HN
Print view View original

11–20 of 322 posts

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#11

Post by StavrosK »

ikeboy wrote: post #7

Source says they also did some input sanitizing along with blocking curl, and they had to make a new PoC to get around that. If I'm reading that right then this isn't really an issue, nothing wrong with defense in depth. Edit: >The update adds several filters to handle single quotes in user input. However, these filters can be evaded by specially crafted inputs. By providing the following string for the certificate's…

I agree, it's just good sense. It's even encapsulated in the bit of folk wisdom about throwing the baby out with the bathwater.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#12

Post by faitswulff »

StavrosK wrote: post #9
beachy wrote: post #4

Earlier quoted context omitted.

Eh? Software can do exactly that.

How? Do you think developers would be so crazy as to add some sort of "--user-agent" option to software like curl that would cause arbitrary strings to be presented as the user agent? Why would somebody write software to do this, just go on the internet and tell lies?

I thought all this security nonsense ended in the 90s when they introduced the IS-MALICIOUS-REQUEST header. It must be, because I haven't seen any web traffic declaring itself malicious since then.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#13

Post by StavrosK »

teraflop wrote: post #10
stavros wrote: post #3

I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.

I guess the biggest problem is that the mitigation isn't future-proof. Someday, there might be other command-line tools besides cURL that can be used for this kind of attack. A better fix would be to just drop all incoming IPv4 packets that have the "evil" bit set. ( https://www.ietf.org/rfc/rfc3514.txt ) Extending this protection to IPv6 is left as an exercise for the reader.

Ah, but what about packets that aren't evil, just gullible and manipulated by some third party?

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#14

Post by fooqux »

StavrosK wrote: post #9
beachy wrote: post #4

Earlier quoted context omitted.

Eh? Software can do exactly that.

How? Do you think developers would be so crazy as to add some sort of "--user-agent" option to software like curl that would cause arbitrary strings to be presented as the user agent? Why would somebody write software to do this, just go on the internet and tell lies?

While that's probably technically feasible, that sounds like something only a terrorist would do anyway. All the more reason to ban the entire program, I say!

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#15

Post by lxe »

stavros wrote: post #3

I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.

Exactly. Hacking your client to use another user-agent or another IP address is illegal under CFAA. See Craigslist Inc. v. 3Taps Inc. etc...

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#16

Post by [deleted] »

fooqux wrote: post #14
StavrosK wrote: post #9

Earlier quoted context omitted.

How? Do you think developers would be so crazy as to add some sort of "--user-agent" option to software like curl that would cause arbitrary strings to be presented as the user agent? Why would somebody write software to do this, just go on the internet and tell lies?

While that's probably technically feasible, that sounds like something only a terrorist would do anyway. All the more reason to ban the entire program, I say!

[deleted]

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#18

Post by Dylan16807 »

ikeboy wrote: post #7

Source says they also did some input sanitizing along with blocking curl, and they had to make a new PoC to get around that. If I'm reading that right then this isn't really an issue, nothing wrong with defense in depth. Edit: >The update adds several filters to handle single quotes in user input. However, these filters can be evaded by specially crafted inputs. By providing the following string for the certificate's…

The equivalent of a "pls dont hack" sign is not defense in depth.

Good to know they at least half fixed the problem, I guess. But that's not enough, and they should be capable of testing this.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#19

Post by maxaf »

StavrosK wrote: post #9
beachy wrote: post #4

Earlier quoted context omitted.

Eh? Software can do exactly that.

How? Do you think developers would be so crazy as to add some sort of "--user-agent" option to software like curl that would cause arbitrary strings to be presented as the user agent? Why would somebody write software to do this, just go on the internet and tell lies?

Your downvoters are terrible at detecting satire.
Post reply on HN