D-Link patch doesn’t address all bugs listed in their own security advisory

#1

Post by PaulSec » Tue, Apr 14, 2015, 9:31 PM UTC

D-Link patch doesn’t address all bugs listed in their own security advisory
devttys0.com

Re: D-Link patch doesn’t address all bugs listed in their own security advisory

#2

Post by carey » Tue, Apr 14, 2015, 9:59 PM UTC

I guess this is a reminder that writing secure C is actually really, really hard.

Re: D-Link patch doesn’t address all bugs listed in their own security advisory

#3

Post by fnordfnordfnord » Tue, Apr 14, 2015, 10:00 PM UTC

Things like this make me so happy to have things like DDWRT, OpenWRT, et al.

Re: D-Link patch doesn’t address all bugs listed in their own security advisory

#4

Post by sdrinf » Tue, Apr 14, 2015, 10:00 PM UTC

Mirror for Database Error'd: https://archive.today/D33zV

Re: D-Link patch doesn’t address all bugs listed in their own security advisory

#5

Post by maxk42 » Tue, Apr 14, 2015, 10:00 PM UTC

carey wrote: post #2

I guess this is a reminder that writing secure C is actually really, really hard.

These are not problems with C. These are problems with a shitty dev team.

Re: D-Link patch doesn’t address all bugs listed in their own security advisory

#6

Post by pyre » Tue, Apr 14, 2015, 10:01 PM UTC

carey wrote: post #2

I guess this is a reminder that writing secure C is actually really, really hard.

Or a reminder that when someone sends you a list of things wrong, maybe you should read and understand it rather than applying a 2 second fix that doesn't actually fix anything?

Re: D-Link patch doesn’t address all bugs listed in their own security advisory

#7

Post by [deleted] » Tue, Apr 14, 2015, 10:01 PM UTC

[deleted]

Re: D-Link patch doesn’t address all bugs listed in their own security advisory

#8

Post by Havoc » Tue, Apr 14, 2015, 10:02 PM UTC

I've just accepted that residential routers are full of assorted orifices (security holes, backdoors & holes in functionality).

Then again I'm not hiding anything dubious - if I was I'd install a firewall box asap. (And yes I know the "nothing to hide" slippery slope etc argument)

Re: D-Link patch doesn’t address all bugs listed in their own security advisory

#9

Post by kkl » Tue, Apr 14, 2015, 10:03 PM UTC

Interesting. The D-Link security advisory (http://securityadvisories.dlink.com/security/publication.asp...) states that the issue was only partially resolved. What was changed (aside from adding an additional buffer overflow) in the patch that attempted to alleviate these issues?

Re: D-Link patch doesn’t address all bugs listed in their own security advisory

#10

Post by ariendj » Tue, Apr 14, 2015, 10:17 PM UTC

pfsense on a thin client = 40$ OpenWRT on a home router as AP = 30$ Not getting pwned = priceless