Results 1 to 7 of 7

Thread: Newly discovered vulnerability

  1. #1
    Whacker Knot WØTKX's Avatar
    Join Date
    Aug 2008
    Location
    Lakewood, CO
    Posts
    26,758

    Newly discovered vulnerability

    https://www.reuters.com/article/us-c...-idUSKBN18L0GD


    A newly found flaw in widely used networking software leaves tens of thousands of computers potentially vulnerable to an attack similar to that caused by WannaCry, which infected more than 300,000 computers worldwide, cybersecurity researchers said on Thursday.

    The U.S. Department of Homeland Security on Wednesday announced the vulnerability, which could be exploited to take control of an affected computer, and urged users and administrators to apply a patch.

    Rebekah Brown of Rapid7, a cybersecurity company, told Reuters that there were no signs yet of attackers exploiting the vulnerability in the 12 hours since its discovery was announced.
    But she said it had taken researchers only 15 minutes to develop malware that made use of the hole. "This one seems to be very, very easy to exploit," she said.

    Rapid7 said it had found more than 100,000 computers running vulnerable versions of the software, Samba, free networking software developed for Linux and Unix computers. There are likely to be many more, it said in response to emailed questions.

    Most of the computers found are running older versions of the software and cannot be patched, said Brown.
    "Where would we be without the agitators of the world to attach the electrodes
    of knowledge to the nipples of ignorance?" ~ Professor "Dick" Soloman



  2. #2
    "Usual Suspect" WZ7U's Avatar
    Join Date
    Jul 2007
    Location
    CN86jc
    Posts
    5,435
    So, riddle me this Batman. If "they" discover a flaw in a widely used software program, why not quietly behind the scenes make the necessary fix instead of planting a bright neon surveyors flag on it and announce it to the world? Is it just me or does that seem counter-intuitive? As simply an end user, I wonder is it really that hard to write code that is a bit more robust? Or is it the rush to sales that drives the production of software?

    It all seems very phishy to me...and now on a Linux system no less

    Like that post was...
    Moving on, my posts are not helpful

  3. #3
    Administrator N8YX's Avatar
    Join Date
    Feb 2007
    Location
    Out in the sticks
    Posts
    26,060
    Researchers will usually disclose a vulnerability to the affected software owners/developers long before making a public announcement. That's typically a "last resort" measure in an attempt to force the development and release of a fix.

    Samba over the Internet? Someone's got themselves a much bigger security problem than a flaw in the module itself.
    "Everyone wants to be an AM Gangsta until it's time to start doing AM Gangsta shit."

  4. #4
    Orca Whisperer n2ize's Avatar
    Join Date
    Dec 2007
    Location
    Crestwood, New York
    Posts
    33,899
    Well, I guess they sort of have to publicize it to push individual users and systems admins to get on the ball and keep their software up to date. Case and point, my system checks for updated versions of it's software daily so that I can keep it up to date with the latest versions of all my installed software. That way there are no lapses and I have the latest bugfixes and vulnerabilities fixed. Surprisingly many systems admins don't seem to keep things updated as they should,
    I keep my 2 feet on the ground, and my head in the twilight zone.

  5. #5
    Administrator N8YX's Avatar
    Join Date
    Feb 2007
    Location
    Out in the sticks
    Posts
    26,060
    Quote Originally Posted by n2ize View Post
    ...Surprisingly many systems admins don't seem to keep things updated as they should,
    ...because certain dependencies on installed components exist, and alteration of said components can break the overlying application.

    This isn't as cut-and-dried as it seems, and a portion of that blame lies at the feet of those who utilize custom API functionality instead of coding to and with industry standard constructs.
    "Everyone wants to be an AM Gangsta until it's time to start doing AM Gangsta shit."

  6. #6
    Orca Whisperer
    Join Date
    Oct 2009
    Location
    Buffalo, NY
    Posts
    22,593
    Quote Originally Posted by WZ7U View Post
    So, riddle me this Batman. If "they" discover a flaw in a widely used software program, why not quietly behind the scenes make the necessary fix instead of planting a bright neon surveyors flag on it and announce it to the world? Is it just me or does that seem counter-intuitive? As simply an end user, I wonder is it really that hard to write code that is a bit more robust? Or is it the rush to sales that drives the production of software?

    It all seems very phishy to me...and now on a Linux system no less
    They generally do. When the news comes out, the fixes are being distributed by the vendor's update system.

    As for why not write more robust code? Yep. We should. Is it harder? Yes. Does it save money shaving corners? Yes.

    Really, I don't pass any code review that I cannot understand, even if via commenting. And, I refuse to accept code that doesn't validate and sanitize inputs too. But, I'm a minority, and since most of mine is system code, I don't have much impact.
    Big Giant Meteor 2020 - We need to make Earth Great Again

    http://www.coreyreichle.com

  7. #7
    Orca Whisperer
    Join Date
    Oct 2009
    Location
    Buffalo, NY
    Posts
    22,593
    Quote Originally Posted by n2ize View Post
    Well, I guess they sort of have to publicize it to push individual users and systems admins to get on the ball and keep their software up to date. Case and point, my system checks for updated versions of it's software daily so that I can keep it up to date with the latest versions of all my installed software. That way there are no lapses and I have the latest bugfixes and vulnerabilities fixed. Surprisingly many systems admins don't seem to keep things updated as they should,
    Now, try doing that without impacting 1-3 thousands interacting components, on distributed servers.

    Therein lies the problem: Orchestration.
    Big Giant Meteor 2020 - We need to make Earth Great Again

    http://www.coreyreichle.com

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •