4 ms·

Think of all OpenWrt/dd-wrt devices - and possibly countless router-boxes around the world that use some proprietary firmware along with dnsmasq. Just verified

by kubov 9y ago

Think of all OpenWrt/dd-wrt devices - and possibly countless router-boxes around the world that use some proprietary firmware along with dnsmasq. Just verified that my home OpenWrt WDR4300 is affected.

pingec 9y ago
How can we verify that?
- jlgaddis 9y ago
  Using the PoCs that Google provided?
- kubov 9y ago
  I simply checked the version of dnsmasq running on my router, it's 2.71 so according to the article the build is affected. I'll try to launch one of the POC later in the day, but for now I assume worst case.
loeg 9y ago
Edgerouter Lite also uses dnsmasq.
hathawsh 9y ago
OpenWrt 15.05.1 "Chaos Calmer" was released more than a year ago. I haven't seen many updates. I wonder if there's an update channel that I'm missing. Specifically, here is where all updates are coming from: https://downloads.openwrt.org/chaos_calmer/15.05.1/ar71xx/generic/packages/base/ https://downloads.openwrt.org/chaos_calmer/15.05.1/ar71xx/ge... No updates since March 2016. EDIT: Has development has moved to the LEDE project? I don't understand what's happening in the OpenWRT/LEDE split. There appears to be a fairly clean upgrade path, though: https://forum.lede-project.org/t/upgrade-from-openwrt-to-lede-does-the-config-compatible/6252 https://forum.lede-project.org/t/upgrade-from-openwrt-to-led...
- e12e 9y ago
  Yes, you probably want Lede, not OpenWRT or dd-wrt. I used lede to flash some old routers last year, and on the whole the experience was similar to my last interaction with OpenWRT only better (more evolved). https://lede-project.org/start https://lede-project.org/start
  - gurrone 9y ago
    I would like to add that you can usually in place upgrade from OpenWRT to LEDE. Though making a config backup and a backup of the list of additional packages you installed is highly recommended. Beside of that just flash and reinstall all additional packages.
    - hathawsh 9y ago
      Upgrading to LEDE worked flawlessly. Thanks guys!
  - gurrone 9y ago
    Might be interesting for some of you, Hauke from LEDE posted a few insides over at LWN: https://lwn.net/Articles/735316/ https://lwn.net/Articles/735316/ https://lwn.net/Articles/735317/ https://lwn.net/Articles/735317/ tl;dr updated packages of dnsmasq are currently building and should be available soon
- pantalaimon 9y ago
  Similar to the OpenOffice/LibreOffice and ownCloud/NextCloud split it seems. Although LEDE and OpenWRT expressed interest to re-merge.
newman314 9y ago
Also the devs of ddwrt do not take security seriously. Requests to include sane defaults for cipher list, dropbear etc. have been met by derision and an outright refusal to do anything about it. For example, the Kong variant updates for http and checksum despite repeated requests to deliver over https. I’ve got quite a few other examples but sadly on mobile right now.
ParadisoShlee 9y ago
OpenWRT is dead. Long Live LEDE.... until they fork LEDE back into the OpenWRT codebase..

by kubov 9y ago

pingec 9y ago

How can we verify that?

jlgaddis 9y ago
Using the PoCs that Google provided?
kubov 9y ago
I simply checked the version of dnsmasq running on my router, it's 2.71 so according to the article the build is affected. I'll try to launch one of the POC later in the day, but for now I assume worst case.

loeg 9y ago

Edgerouter Lite also uses dnsmasq.

hathawsh 9y ago

OpenWrt 15.05.1 "Chaos Calmer" was released more than a year ago. I haven't seen many updates. I wonder if there's an update channel that I'm missing. Specifically, here is where all updates are coming from: https://downloads.openwrt.org/chaos_calmer/15.05.1/ar71xx/generic/packages/base/ https://downloads.openwrt.org/chaos_calmer/15.05.1/ar71xx/ge... No updates since March 2016. EDIT: Has development has moved to the LEDE project? I don't understand what's happening in the OpenWRT/LEDE split. There appears to be a fairly clean upgrade path, though: https://forum.lede-project.org/t/upgrade-from-openwrt-to-lede-does-the-config-compatible/6252 https://forum.lede-project.org/t/upgrade-from-openwrt-to-led...

e12e 9y ago
Yes, you probably want Lede, not OpenWRT or dd-wrt. I used lede to flash some old routers last year, and on the whole the experience was similar to my last interaction with OpenWRT only better (more evolved). https://lede-project.org/start https://lede-project.org/start
- gurrone 9y ago
  I would like to add that you can usually in place upgrade from OpenWRT to LEDE. Though making a config backup and a backup of the list of additional packages you installed is highly recommended. Beside of that just flash and reinstall all additional packages.
  - hathawsh 9y ago
    Upgrading to LEDE worked flawlessly. Thanks guys!
- gurrone 9y ago
  Might be interesting for some of you, Hauke from LEDE posted a few insides over at LWN: https://lwn.net/Articles/735316/ https://lwn.net/Articles/735316/ https://lwn.net/Articles/735317/ https://lwn.net/Articles/735317/ tl;dr updated packages of dnsmasq are currently building and should be available soon
pantalaimon 9y ago
Similar to the OpenOffice/LibreOffice and ownCloud/NextCloud split it seems. Although LEDE and OpenWRT expressed interest to re-merge.

newman314 9y ago

Also the devs of ddwrt do not take security seriously. Requests to include sane defaults for cipher list, dropbear etc. have been met by derision and an outright refusal to do anything about it. For example, the Kong variant updates for http and checksum despite repeated requests to deliver over https. I’ve got quite a few other examples but sadly on mobile right now.

ParadisoShlee 9y ago

OpenWRT is dead. Long Live LEDE.... until they fork LEDE back into the OpenWRT codebase..