Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

twitter.com

Post reply on HN
Print view View original

51–60 of 322 posts

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#51

Post by trhway »

danso wrote: post #8

Of all the security post-mortems I’ve ever wanted to read, it’s sad I’ll probably never get to read this one and its tale of how a team of well-paid comfortable engineers got together and decided this patch was a good idea.

i'll raise you a case where a team of very well paid senior engineers/architects and PMs dismissed a remote execution vulnerability down to a very low "some next release" priority on the grounds that "notepad.exe doesn't seem to do any damage" - as you may have guessed the vulnerability PoC used notepad.exe . After seeing that with my own eyes, this Cisco curl is just "meh" for me :)

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#52

Post by altmind »

MiddleEndian wrote: post #20

User agents shouldn't exist any more. They serve only to help unsuspecting users be fingerprinted.

Considering recent chrome, firefox user agent contains id string of almost every browser in existence, this is so true:

Mozilla/5.0 (...) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#53

Post by 0xcde4c3db »

danso wrote: post #8

Of all the security post-mortems I’ve ever wanted to read, it’s sad I’ll probably never get to read this one and its tale of how a team of well-paid comfortable engineers got together and decided this patch was a good idea.

Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation:

Engineer Alice: We should really fix this properly.

Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue?

Engineer Bob: Uh, ten percent on a good day? Do you remember the last time we applied a "simple" hotfix to this function? I almost had to sleep under my desk.

Manager: And we can just prevent it with an extra regex rule in the front end code?

Engineer Alice: ... Yes. irrepressibly existential sigh

Manager: How much QA effort to call this good?

QA Engineer: We can run through a cut-down version of the acceptance test suite in four or five hours.

Manager: And for the proper fix?

QA Engineer: Oh, hell, at least a week of stress testing to really be sure.

Manager: Add the regex rule.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#56

Post by coldacid »

0xcde4c3db wrote: post #53
danso wrote: post #8

Of all the security post-mortems I’ve ever wanted to read, it’s sad I’ll probably never get to read this one and its tale of how a team of well-paid comfortable engineers got together and decided this patch was a good idea.

Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation: Engineer Alice: We should really fix this properly. Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue? Engineer Bob: Uh, ten percent on a good day?…

Bob is either a brown-noser or a complete turncoat. Don't be like Bob.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#58

Post by acheron »

stavros wrote: post #33
mehrdadn wrote: post #30

Earlier quoted context omitted.

They help you figure out if a user agent wants a mobile view of a page without Javascript... which is pretty useful.

We don't need user agents for that. There's an easy way to tell whether a visitor wants a cleaner view of a page, without Javascript: Yes.

I have been having a shitty day and your comments in this article have honestly cheered me up a bit. Thank you!

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#59

Post by hnick »

Arnavion wrote: post #37
ikeboy wrote: post #7

Source says they also did some input sanitizing along with blocking curl, and they had to make a new PoC to get around that. If I'm reading that right then this isn't really an issue, nothing wrong with defense in depth. Edit: >The update adds several filters to handle single quotes in user input. However, these filters can be evaded by specially crafted inputs. By providing the following string for the certificate's…

Speaking of filtering, the diff between the two exploits is: -"common_name=a'\$(ping -c 4 192.168.1.2)'b" +"common_name='a\$(ping -c 4 192.168.1.2)'b" and POST instead of GET (and kurl as the UA, of course). Does their fix specifically check for injection starting with `a'` ? And only works for GET requests? Mind-boggling... Edit: The new exploit also targets https instead of http. I would've said that surely that wo…

"As a user, when I send a request like below I want it to not pwn the router."
Post reply on HN