Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

twitter.com

Post reply on HN
Print view View original

301–310 of 322 posts

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#301

Post by craftinator »

kowdermeister wrote: post #284
craftinator wrote: post #282

Earlier quoted context omitted.

Yes, very well, as first action of the Joke Approval Committee, I propose that this august body instantiate the Recursed Approval Subcommittee, whose role will be to instantiate the Recursed Approval Subcommittee.

That's a perfect example you should post to JAC before. It would not pass, please never post this "joke" again. Welcome on board :)

As soon as the subcommittees hit their break condition (0), they'll break for coffee and donuts, and I can submit my "joke" to the JAC. And I don't make a habit of repeatedly posting the same joke, but I cannot make the promise in this case.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#302

Post by tjalfi »

derpherpsson wrote: post #159
chii wrote: post #145

Earlier quoted context omitted.

> I want my socially maladept neckbeards and terminal junkies back plz. the MBA types don't like these hacker types - personality clash and whatnots. But the MBA types control the company from above, and the hacker types don't like to do management work. The result is obvious.

Some time ago I went through the list of all the major router manufacturers and rated them on 1) security, and 2) long term usability, and 3) culture. My conclusion was that I would buy my infrastructure from Allied Telesis. It's pretty much a Japanese version of Cisco, but it's still healthy. Ubiquity was number 2. I refrain from buying from them only because of their glossy UI. Mikrotik was on that list. Until I sa…

I had several Allied Telesis switches at a previous job. The hardware was fine but resetting the configuration password was a remarkably painful process.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#303

Post by PinkMilkshake »

stavros wrote: post #3

I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.

They might be able to fix it by making the only valid user agent “not-curl-honest”.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#304

Post by adontz »

derpherpsson wrote: post #253
Asooka wrote: post #225

Earlier quoted context omitted.

Can you elaborate on Mikrotik? I've only heard good things about them and am very satisfied with the one hAP I bought from them.

They have had several remote code execution vulnerabilities lately (summer 2018). While they were very quick to patch them they did not notify their customers in any way. There was nothing on their website that said anything about the urgency. Instead of reusing functionality that exists in the router already (ssh?), the authentication for winbox is something they built themselves. It was in the winbox auth that the…

WinBox is not that simple and cannot be replaced with SSH. WinBox works on Ethernet level, so one can connect to router by MAC address and recover when IP level configuration is invalid.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#305

Post by emptyfile »

konstmonst wrote: post #256
pjmlp wrote: post #186

Earlier quoted context omitted.

Quitting assumes the possibility of finding a job around the corner and not having people that depend on you.

You might be surprised, but if you move to Europe, it is actually so! Move to Berlin of Frankfurt. There is always work for Software Developer here, it is hard not to get one and you get spammed by recruiters all the time. You don't have to take shit from management, you can just go elsewhere. Everything is also very near.

Well as a European I find the "uproot your life for a better job" mentality completely alien. Short of a war I'm not sure what would make me leave the place I call home.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#306

Post by rkeene2 »

techntoke wrote: post #121
rkeene2 wrote: post #115

Earlier quoted context omitted.

This is not too helpful -- you can resize the window in such a way that the ratio changes...

Send the screen resolution

For which screens ? Why would that be helpful in any case, given the browser window is not the size of any of the screens ? I'm not sure what you would gain from getting this information.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#308

Post by webninja »

stavros wrote: post #3

I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.

Actually you can use -A to change the user agent in Curl itself. For example:

  curl -A "YourNewUserAgentString” http://url.com
Furthermore, there are free plugins or add-ons for both Chrome and Firefox that let you change the user agent and say you’re using IE, a mobile browser, a google bot, or anything you want the user agent string to say.

Most programmers should be able to write a small script using Python’s urllib or urllib2 to do a basic PUT or GET request with any User Agent. Heck, just type “change user agent python urllib” into google, click on the first stack overflow link, and copy/paste the answer. You can use Go, ruby, java, nodeJS, or PHP instead as well.

Edit: Maybe your comment was sarcasm :)

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#309

Post by mikevp »

amalcon wrote: post #114
anyfoo wrote: post #84

Earlier quoted context omitted.

No! The answer is an unequivocal “No“, without any „but“s or anything like that. The fix does not fix the problem, it is not even a fix, just a wrong code change that sets out to do something but does not achieve it. Answering „yes“ is a lie here. This is different from a fix that fixes the problem in an ugly way, where „yes, but...“ is applicable.

In this specific case (I have never encountered a proposal quite this bad), the correct answer is probably "Give me the proof of concept code and about ten minutes, and I'll give you a version that works despite the patch." You're right about that. "No" is likely to bog down the discussion with "but Bob says it will work", and it's better to skip to the end. I'm envisioning more of a middle-ground case, where the cod…

Ten minutes? How long does it take to type a user agent string into the curl command line?

In my case, a user agent string pretending to be Firefox is already part of my .curlrc, so it's no time at all, just grab the PoC code and fire away. (I've got commented out user-agent lines for a bunch of other browsers that I can uncomment as the need or mood strikes me.)

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#310

Post by webninja »

dvhh wrote: post #298
StavrosK wrote: post #169

Earlier quoted context omitted.

I think I'd almost prefer an "alignment" flag, so we don't mischaracterize all the Chaotic Neutral packets.

But then what to do with the Lawful Evil packets ?

Add an x-Lawful-Warrant parameter to provide a warrant. It can’t be read by anything but the best AI technology and is included in every HTTP request. No warrant, no response!
Post reply on HN