Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

emily.id.au

Post reply on HN
Print view View original

11–20 of 147 posts

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#11

Post by bombcar »

tailspin2019 wrote: post #7

> The speed and quality of Tailscale's response to our report is unlike any vendor interaction I have experienced, and suggests a deep commitment to keeping their customers safe. I have mixed feelings here as a Tailscale customer. Yes a quick response is great, but this actual security issue is pretty terrible IMHO. Anything other than an immediate response would have been akin to lighting their company on fire and w…

Your username would have been a good option for a cutesy name for the vulnerability, however.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#12

Post by bradfitz »

jakedata wrote: post #3

The client app is not indicating that 1.32.3 for Windows is available yet but the download link on the site has been updated. Tailscale client downloads are extremely slow at the moment, so I suggest you distribute one copy manually around your tailnet rather than bogging down their servers even more.

If you restart the windows GUI it should refresh the cache and show the update is available. Otherwise it can take some hours.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#14

Post by mlyle »

arkadiyt wrote: post #8
meibo wrote: post #5

Do they have enough logs to reach out to people that were affected? As far as vulnerabilities go, this set is one is one of the worst ones I've seen this decade, and they seem rather straightforward. Would be nice to get a blog post from them that goes a bit into impact, not just a report that tells you to update. It's nice that they responded quickly, but I feel like this shouldn't have happened in the first place f…

edit: I stand corrected as pointed out by the replies below. Curious what logs they had to prove this! Original comment: > Do they have enough logs to reach out to people that were affected? It happens on the client, there are no server logs that Tailscale could check

"Reviewing all logs confirms this vulnerability was not triggered or exploited."

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#15

Post by hellcow »

tailspin2019 wrote: post #7

> The speed and quality of Tailscale's response to our report is unlike any vendor interaction I have experienced, and suggests a deep commitment to keeping their customers safe. I have mixed feelings here as a Tailscale customer. Yes a quick response is great, but this actual security issue is pretty terrible IMHO. Anything other than an immediate response would have been akin to lighting their company on fire and w…

> Anything other than an immediate response would have been akin to lighting their company on fire and walking away.

Have we forgotten Zoom, who reinstalled itself secretly on user machines with an RCE-vulnerable server, which they described as “working as intended?” They’re still wildly popular today with organizations despite the insane lack of regard for security and their users’ safety.

Mistakes happen. I applaud Tailscale for moving so quickly and doing the right thing.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#16

Post by meibo »

ferbivore wrote: post #13

Releasing a patch and a detailed write-up on the same day seems like a bit of an unfortunate choice, especially for a WTF!! vulnerability like this. In software that doesn't auto-update, no less...

Especially as the fixes seemingly have been going into their public GitHub branch for days, since the report. I wonder if that was a conscious choice or negligience, maybe I'm missing something? I would expect these to be released as patches/merged in when the vulnerability is published, like a lot of other security-critical open source software does it.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#17

Post by ripley12 »

meibo wrote: post #5

Do they have enough logs to reach out to people that were affected? As far as vulnerabilities go, this set is one is one of the worst ones I've seen this decade, and they seem rather straightforward. Would be nice to get a blog post from them that goes a bit into impact, not just a report that tells you to update. It's nice that they responded quickly, but I feel like this shouldn't have happened in the first place f…

Yes. I got a (concise, well-written) email this morning with the following:

> Am I affected?

> Yes. Your tailnet has at least one Windows node running a version of Tailscale prior to v1.32.3.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#18

Post by [deleted] »

mlyle wrote: post #14
arkadiyt wrote: post #8

Earlier quoted context omitted.

edit: I stand corrected as pointed out by the replies below. Curious what logs they had to prove this! Original comment: > Do they have enough logs to reach out to people that were affected? It happens on the client, there are no server logs that Tailscale could check

"Reviewing all logs confirms this vulnerability was not triggered or exploited."

[deleted]

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#19

Post by amluto »

I don't see a writeup of how this was fixed. Merely checking the Host header is insufficient -- the vulnerability would still be wide open to anyone who can open TCP sockets to localhost.

Windows has APIs (named pipes, DCOM (eww) and such) that allow authenticated local access to services. Unixes have unix sockets.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#20

Post by Arnavion »

amluto wrote: post #19

I don't see a writeup of how this was fixed. Merely checking the Host header is insufficient -- the vulnerability would still be wide open to anyone who can open TCP sockets to localhost. Windows has APIs (named pipes, DCOM (eww) and such) that allow authenticated local access to services. Unixes have unix sockets.

Windows from W10 onwards has Unix sockets too.
Post reply on HN