Text only | Text with Images

Artix Linux Forum

General Category => General Discussion => Topic started by: n00b on 26 September 2024, 04:18:55

Title: decade old RCE flaw in linux?
Post by: n00b on 26 September 2024, 04:18:55
https://cybersecuritynews.com/critical-unauthenticated-rce-flaw/

Title: Re: decade old RCE flaw in linux?
Post by: lq on 26 September 2024, 07:20:43
RTFM:

https://en.wikipedia.org/wiki/Snake_oil
Title: Re: decade old RCE flaw in linux?
Post by: Penaz on 26 September 2024, 08:55:51
I assume the RCE flaw that is spoken about is the one talked about by (somewhat well-known) Italian security aficionado evilsocket (see https://threadreaderapp.com/thread/1838169889330135132.html).

There is a timeline for release of details, it seems that there will be an initial release on OpenWall around September 30th, 2024.

I wouldn't assume so quickly that it's snake oil, but as all things it should be taken with a grain of salt.

It seems that EvilSocket is in contact with Canonical and RedHat, so all the correct procedures for reporting a security vulnerability are being followed, apparently.

I would say, let's see what comes out of it.
Title: Re: decade old RCE flaw in linux?
Post by: ####### on 26 September 2024, 15:08:27
I came across this recently, although it's not a new discovery:
https://thehackernews.com/2019/08/dslr-camera-hacking.html
https://www.techradar.com/pro/security/this-devious-wi-fi-security-flaw-could-let-hackers-eavesdrop-on-your-network-with-ease

A lot of cameras and camcorders have included built in wifi for many years, on many devices it's permanently enabled with no "off" switch or setting. They don't get updates to fix security holes either, unless the manufacturer releases a new firmware version and the user installs it, both of which are unlikely. The camera can be remotely accessed for spying, existing pictures and videos can be viewed or it might be possible to use this as a route to install malware on your computer when you connect to the camera. The access can also be used to destroy the camera or for data deletion. Other internet enabled devices on your network might also create weaknesses, something to consider besides your computer itself.
Title: Re: decade old RCE flaw in linux?
Post by: corysanin on 26 September 2024, 22:32:39
Quote from: lq – on
RTFM:

https://en.wikipedia.org/wiki/Snake_oil

Do you get off on posting RTFM? There's skepticism and then there's this.
Title: Re: decade old RCE flaw in linux?
Post by: n00b on 27 September 2024, 19:03:24
its cups

https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
Title: Re: decade old RCE flaw in linux?
Post by: lq on 02 October 2024, 08:18:22
Quote from: corysanin – on
Do you get off on posting RTFM? There's skepticism and then there's this.

The rapidly advancing stultification can be recognised not least by the fact that more and more people perceive reading and understanding as two completely different, completely independent processes.

Or which part of "Read The Friendly Manual" is too complicated for you?
Title: Re: decade old RCE flaw in linux?
Post by: gripped on 02 October 2024, 14:20:09
Quote from: lq – on
Or which part of "Read The Friendly Manual" is too complicated for you?
RTFM = "Read the fucking manual" not "Read the friendly manual."

For some reason you are hiding behind a bowdlerisation?

If I write STFU everybody will read that as "Shut the fuck up" not "Save the friendly Unicorn" no matter what I claim as my intended meaning.
Let's at least call a spade a spade
Title: Re: decade old RCE flaw in linux?
Post by: jahway603 on 03 October 2024, 04:48:29
Hackthebox has a machine just released today to learn how to exploit this CUPS vuln

Quote
About EvilCUPS
EvilCUPS is a Medium difficulty Linux machine that features a CUPS Command Injection Vulnerability [CVE-2024-47176](https://nvd.nist.gov/vuln/detail/CVE-2024-47176). This CVE allows remote unauthenticated users the ability to install a malicious printer on the vulnerable machine over `UDP/631`. This printer is configured to utilize [Foomatic-RIP](https://linux.die.net/man/1/foomatic-rip) which is used to process documents and where the command injection happens. In order to trigger the command execution, a document needs to be printed. The CUPS Webserver is configured to allow anonymous users access to `TCP/631`. Navigating here makes it possible to print a test page on the malicious printer and gain access as the "lp" user. This user the ability to retrieve past print jobs, one of which contains the root password to the box.
Title: Re: decade old RCE flaw in linux?
Post by: n00b on 04 October 2024, 17:00:34
Quote from: jahway603 – on
Hackthebox has a machine just released today to learn how to exploit this CUPS vuln

Quote
About EvilCUPS
EvilCUPS is a Medium difficulty Linux machine that features a CUPS Command Injection Vulnerability [CVE-2024-47176](https://nvd.nist.gov/vuln/detail/CVE-2024-47176). This CVE allows remote unauthenticated users the ability to install a malicious printer on the vulnerable machine over `UDP/631`. This printer is configured to utilize [Foomatic-RIP](https://linux.die.net/man/1/foomatic-rip) which is used to process documents and where the command injection happens. In order to trigger the command execution, a document needs to be printed. The CUPS Webserver is configured to allow anonymous users access to `TCP/631`. Navigating here makes it possible to print a test page on the malicious printer and gain access as the "lp" user. This user the ability to retrieve past print jobs, one of which contains the root password to the box.

So, what about RTFM is relevant to this discussion?
Title: Re: decade old RCE flaw in linux?
Post by: replabrobin on 04 October 2024, 17:48:03
Just when we were ready to relax

https://arstechnica.com/security/2024/10/persistent-stealthy-linux-malware-has-infected-thousands-since-2021/ (https://arstechnica.com/security/2024/10/persistent-stealthy-linux-malware-has-infected-thousands-since-2021/)
Title: Re: decade old RCE flaw in linux?
Post by: Shoun2137 on 04 October 2024, 21:43:08
Quote from: replabrobin – on
Just when we were ready to relax

https://arstechnica.com/security/2024/10/persistent-stealthy-linux-malware-has-infected-thousands-since-2021/ (https://arstechnica.com/security/2024/10/persistent-stealthy-linux-malware-has-infected-thousands-since-2021/)
it uses systemd to stay persistent, so i guess it can fuck off outta our lawn xd

edit: smh, more red flags such as executable /tmp that shouldve been mounted as noexec (anything legit that tries to exec in /tmp should be accounted for from user's manual intervention)
Text only | Text with Images