3 ms·

How much fallout will F5 really see from this bug though?

by trome 10y ago

discreditable 10y ago
Probably none. Especially when you see mentioned in the article that chromium makes sure their ClientHello is not in the 256-512b range to avoid breaking F5 servers. https://bugs.chromium.org/p/chromium/issues/detail?id=315828 https://bugs.chromium.org/p/chromium/issues/detail?id=315828
- pfg 10y ago
  Maybe I'm missing something, but I don't see how these issues are related. One is a compatibility workaround, the other is a vulnerability that exposes server memory to a remote attacker.
  - discreditable 10y ago
    F5's poor coding practices are the common denominator.
- cesarb 10y ago
  The cause of that particular bug was that a ClientHello in that size range looked like a SSL2 (!) handshake, and these boxes were looking for a SSL2 handshake before looking for a SSL3 handshake: https://www.ietf.org/mail-archive/web/tls/current/msg10423.html https://www.ietf.org/mail-archive/web/tls/current/msg10423.h... Interestingly, this new "ticketbleed" vulnerability could completely erradicate that bug, in the quite probable case that all versions of the F5 software which fix ticketbleed also have the much older fix for that ClientHello bug.
  - kayfox 10y ago
    The SSL2 issue was fixed in 11.2.1 HF11 and 11.4.0, so it should be long fixed in all supported versions at this point.
adjkant 10y ago
Little to none, but I think this story was actually genuinely cool to read for some reason. I still can't put my finger on it.
- AndyKelley 10y ago
  It's a story about competent people handling a bug responsibly. Nothing sensational, but deeply satisfying nonetheless.
- jgrahamc 10y ago
  I found it cool also and ultimately I'm Filippo's boss. The fun part is that he found this by accident while debugging a customer problem and he worked quietly with F5 to disclose (so quietly I found out about this a couple of days ago). Also Filippo does a good job of telling the story in his blog post. I don't get the "fallout for F5" part. A bug was found, a vendor informed, everyone worked together in a responsible manner. Happiness!
  - vinhboy 10y ago
    That really was a well written article. I know almost nothing about F5, TLS, Go, etc... and I had no trouble understanding the bug. Very educational. The man deserves a beer.
    - jgrahamc 10y ago
      I'll tell him.
- rudolf0 10y ago
  It's straightforward, it's not trying to shill Cloudflare products too much, it's not self-congratulatory, and it's told from the chronological first-person perspective of an engineer trying to debug a protocol issue and accidentally uncovering a critical vuln. Basically, it wasn't written by a marketing department like most of these other company-found vuln disclosures.

How much fallout will F5 really see from this bug though?

by trome 10y ago

How much fallout will F5 really see from this bug though?

Probably none. Especially when you see mentioned in the article that chromium makes sure their ClientHello is not in the 256-512b range to avoid breaking F5 servers. https://bugs.chromium.org/p/chromium/issues/detail?id=315828 https://bugs.chromium.org/p/chromium/issues/detail?id=315828

pfg 10y ago
Maybe I'm missing something, but I don't see how these issues are related. One is a compatibility workaround, the other is a vulnerability that exposes server memory to a remote attacker.
- discreditable 10y ago
  F5's poor coding practices are the common denominator.
cesarb 10y ago
The cause of that particular bug was that a ClientHello in that size range looked like a SSL2 (!) handshake, and these boxes were looking for a SSL2 handshake before looking for a SSL3 handshake: https://www.ietf.org/mail-archive/web/tls/current/msg10423.html https://www.ietf.org/mail-archive/web/tls/current/msg10423.h... Interestingly, this new "ticketbleed" vulnerability could completely erradicate that bug, in the quite probable case that all versions of the F5 software which fix ticketbleed also have the much older fix for that ClientHello bug.
- kayfox 10y ago
  The SSL2 issue was fixed in 11.2.1 HF11 and 11.4.0, so it should be long fixed in all supported versions at this point.

adjkant 10y ago

Little to none, but I think this story was actually genuinely cool to read for some reason. I still can't put my finger on it.

AndyKelley 10y ago
It's a story about competent people handling a bug responsibly. Nothing sensational, but deeply satisfying nonetheless.
jgrahamc 10y ago
I found it cool also and ultimately I'm Filippo's boss. The fun part is that he found this by accident while debugging a customer problem and he worked quietly with F5 to disclose (so quietly I found out about this a couple of days ago). Also Filippo does a good job of telling the story in his blog post. I don't get the "fallout for F5" part. A bug was found, a vendor informed, everyone worked together in a responsible manner. Happiness!
- vinhboy 10y ago
  That really was a well written article. I know almost nothing about F5, TLS, Go, etc... and I had no trouble understanding the bug. Very educational. The man deserves a beer.
  - jgrahamc 10y ago
    I'll tell him.
rudolf0 10y ago
It's straightforward, it's not trying to shill Cloudflare products too much, it's not self-congratulatory, and it's told from the chronological first-person perspective of an engineer trying to debug a protocol issue and accidentally uncovering a critical vuln. Basically, it wasn't written by a marketing department like most of these other company-found vuln disclosures.