Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RCE via ND6 Router Advertisements in FreeBSD

freebsd.org

Post reply on HN
Print view View original

51–60 of 85 posts

Re: RCE via ND6 Router Advertisements in FreeBSD

#51

Post by matheusmoreira »

IshKebab wrote: post #48
valleyer wrote: post #44

Earlier quoted context omitted.

I can't tell whether you're making a joke, seeing as the entire BSD init system is built on shell scripts.

Not a joke. I knew they used to use a pile of janky shell scripts for their init system. I didn't know they still do. That's disappointing. And cesarb is correct - the issue isn't scripts; it's shell scripts, especially Bash and similar. Something like Deno/Typescript would be a decent option for example. Nushell is probably acceptable. Even Python - while a terrible choice - is a better option than shell scripts.

The issue is POSIX standardizing legacy stuff like shells, thereby tempting people to write "portable" software, leading these technologies to ossify and stick with us for half a century and counting. Someone comes along and builds something better but gets threatened for not following "the UNIX way".

Re: RCE via ND6 Router Advertisements in FreeBSD

#52

Post by elcritch »

clan wrote: post #28

This actually makes me happy! I must be getting old! It truly is a bad one but I really appreciate Kevin Day for finding/reporting this and for all the volunteer work fixing this. All I had to do was "freebsd-update fetch install && reboot" on my systems and I could continue my day. Fleet management can be that easy for both pets and cattle. I do however feel for those who have deployed embedded systems. We can only…

If it’s a shell script fix does it even need a reboot?

Re: RCE via ND6 Router Advertisements in FreeBSD

#53

Post by cornonthecobra »

clan wrote: post #28

This actually makes me happy! I must be getting old! It truly is a bad one but I really appreciate Kevin Day for finding/reporting this and for all the volunteer work fixing this. All I had to do was "freebsd-update fetch install && reboot" on my systems and I could continue my day. Fleet management can be that easy for both pets and cattle. I do however feel for those who have deployed embedded systems. We can only…

Even better, the reboot wasn't needed as the kernel didn't get bumped on this one. Just restart the rtsold service if you're using it and sanity check your resolv.conf and resolvconf.conf.

As for noticing it quickly, add `freebsd-update cron` to crontab and it will email you the fetch summary when updates are available

Re: RCE via ND6 Router Advertisements in FreeBSD

#54

Post by MisterTea »

IshKebab wrote: post #38
chaz6 wrote: post #30

Having a shell script in the code path that processes router advertisements seems sub-optimal.

It's amazing the number of people that thing shell scripts should be anything other than throwaway single-person hacks. They should probably go through their whole system and verify that there aren't more shell scripts being used, e.g. in the init system. Ideally a default distro would have zero shell scripts.

Unfortunately your joke has wooshed over quite a few heads but what you say is true. The shell should be one of the most reliable parts of your operating system. Why on earth would you NOT trust the primary interface of your OS? Makes no sense.

Re: RCE via ND6 Router Advertisements in FreeBSD

#55

Post by wmf »

MisterTea wrote: post #54
IshKebab wrote: post #38

Earlier quoted context omitted.

It's amazing the number of people that thing shell scripts should be anything other than throwaway single-person hacks. They should probably go through their whole system and verify that there aren't more shell scripts being used, e.g. in the init system. Ideally a default distro would have zero shell scripts.

Unfortunately your joke has wooshed over quite a few heads but what you say is true. The shell should be one of the most reliable parts of your operating system. Why on earth would you NOT trust the primary interface of your OS? Makes no sense.

The shell itself may be reliable but shell scripts are notorious for security issues.

Re: RCE via ND6 Router Advertisements in FreeBSD

#56

Post by immibis »

zokier wrote: post #36
immibis wrote: post #18

Earlier quoted context omitted.

As it should be. If your ISP isn't giving you ipv6, they're not giving you internet access and you should sue for your money back.

With such confidence in your comment, I'm sure you can point out many successful precedents for such cases.

There's a federal mandate to implement IPv6 by... the end of this year. So in about 2-3 weeks.

Re: RCE via ND6 Router Advertisements in FreeBSD

#57

Post by wmf »

VoidWhisperer wrote: post #33

> no workaround > IPv6 users that do not configure the system to accept router advertisement messages, are not affected. Maybe I'm missing something but isnt that a workaround?

Router advertisements are pretty much required to use IPv6 unless you configure everything statically.

Re: RCE via ND6 Router Advertisements in FreeBSD

#58

Post by bah_humbug »

> resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.

The fix consists of implementing an XXX present since the code was added:

    /*
     * XXX validate that domain name only contains valid characters
     * for two reasons: 1) correctness, 2) we do not want to pass
     * possible malicious, unescaped characters like `` to a script
     * or program that could be exploited that way.
     */
https://www.freebsd.org/security/patches/SA-25:12/rtsold.pat...

Re: RCE via ND6 Router Advertisements in FreeBSD

#59

Post by jrmg »

rs_rs_rs_rs_rs wrote: post #7

IPv6 is a prerequisite for the bug to be exploited, it won't affect anyone.

Major home and mobile internet providers in the US, at least, have IPv6 on by default now.

Google tracks IPv6 adoption at almost 50% globally and over 50% in the USA (https://www.google.com/intl/en/ipv6/statistics.html)

IPv6 is mainstream.

Re: RCE via ND6 Router Advertisements in FreeBSD

#60

Post by jandrese »

bah_humbug wrote: post #58

> resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed. The fix consists of implementing an XXX present since the code was added: /* * XXX validate that domain name only contains valid characters * for two reasons: 1) correctness, 2) we do not want to pass * possible malicious, unescaped characters like `` to a sc…

It is wild that it was in that state for so long. It probably took just about as long to write that comment as it would have to implement the proper solution.
Post reply on HN