I think the official CTF is up here:
replyserver: nginx/1.14.0 (Ubuntu)
Lool.
replyList of vulns in nginx/1.14.0: https://www.cybersecurity-help.cz/vdb/soft/f5_networks/nginx...
Backported security patches don't bump the version string.
reply^this sure made my day, lol
replythanks for that :)
If someone does a v2 let's hope they make sure it's actually exploitable when they set it up so they don't leave hundreds of people with the assumption that the cve is not a big deal when the CTF was just misconfigured and the system got pwned in less than 2 hrs after they fixed it
replyCVSS in general is not the best proxy for "real world impact". You could have a 10 on a software thats only deployed once and the impact would be tiny. In this case, multipath is not used that much (except by go).
replyGo is everywhere in server environment. It's absurd to claim that multipath is not used that much. Maybe it's me, but go literally everywhere around me.
replyAlso this vulnerability is not strictly about mptcp, although the exploitability is not clear.
But they have very valid point: a CVE 10.0 with root RCE on twenty internal servers is lower risk than one vulnerable internet-facing server. All need to be patched, but the one on the Internet is your critical risk, the others are medium at worse.
replyI think it's less of a concern over the internet because the kind of packet necessary for the exploit tends to be filtered out, but it's pretty scary as an escalation mechanism from e.g. an end-user device to a core server.
replyMuch like with PHP2Shell, it doesn't need to be utterly trivially exploitable to be a big concern.
Contrast this with: "The Gift of It's Your Problem Now"
replyWe keep doing this to ourselves. Heads should roll at Ubuntu. Start that process right now? You can't. You see, nobody is directly available to sue. It does seem that nobody ever truly cared about that. The insecure codebase and tech debt shall continue to grow because that is the gift.
https://apenwarr.ca/log/20211229-the-gift-of-its-your-proble...