3 ms·
Maybe the blog post is just ambiguously worded but I'd like a confirmation from them if so. You are only affected if one of the below settings is applied:
by ghostpepper 3y ago
Maybe the blog post is just ambiguously worded but I'd like a confirmation from them if so.
You are only affected if one of the below settings is applied:
ipv6/settings/ set accept-router-advertisements=yes
or
ipv6/settings/set forward=no accept-router-advertisements=yes-if-forwarding-disabled
Specifically I'd like to know whether this config is vulnerable:
/ipv6/settings/set disable-ipv6=yes forward=no accept-router-advertisements=yes-if-forwarding-disabled
- bombcar 3y agoIt is ambiguous but I'd hope that disable-ipv6 would override everything else. I had /ipv6/settings/print disable-ipv6: no forward: yes accept-redirects: yes-if-forwarding-disabled accept-router-advertisements: yes-if-forwarding-disabled max-neighbor-entries: 8192 which I interpreted as "maybe" being ok? But I upgraded anyway.
- crest 3y agoRun `/ipv6/settings/export verbose` to show you the combination of your configuration and the default values on the relevant subtree. I would've expected the `disable-ipv6` to disable all ICMPv6 processing including the code paths leading to the RCE vulnerability, but the post doesn't state it explicitly.