4 ms·

This actually seems great. They’re taking the hard path here admitting the devices are compromised, that the state can’t be trusted, and that the machine needs

This actually seems great. They’re taking the hard path here admitting the devices are compromised, that the state can’t be trusted, and that the machine needs to be tossed. Then they’re offering to replace the vulnerable devices. I’m used to companies taking the “deny, deny, deny” route and these articles are then written by their community saying the response is insufficient.

xen2xen1 3y ago
Agreed. Better response than normal. Also gives them an avenue to see how many have been actively used? Maybe that's just me.
stefan_ 3y ago
Who would want a replacement "email security gateway" after the previous version was found to do the equivalent of system(<untrusted email input>)? When is our industry going to agree on a standard where we go "no, that is too dumb, too far"? This "oh there was an issue but it's fixed now" doesn't begin to address the severity of the fuckup this is.
- Hnrobert42 3y ago
  It doesn’t take much for a machine to become irrevocably tainted, so the fact that they are doing a recall doesn’t, in and of itself, say much about the magnitude. Do you have some other data to substantiate your ire or are you just piling on?
  - fsh 3y ago
    From the security advisory: > The vulnerability stemmed from incomplete input validation of user supplied .tar files as it pertains to the names of the files contained within the archive. Consequently, a remote attacker could format file names in a particular manner that would result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. I would not be comfortable to continue using a product that contained such an egregious flaw.
    - 8organicbits 3y ago
      Improper input validation chained to command injection? Those are quite common unfortunately.
- chrisandchris 3y ago
  So you will never buy a car because every manufacturer at some point already fucked something up with accelerate/break which means none of these can be trusted anymore?

xen2xen1 3y ago

Agreed. Better response than normal. Also gives them an avenue to see how many have been actively used? Maybe that's just me.

stefan_ 3y ago

Who would want a replacement "email security gateway" after the previous version was found to do the equivalent of system(<untrusted email input>)? When is our industry going to agree on a standard where we go "no, that is too dumb, too far"? This "oh there was an issue but it's fixed now" doesn't begin to address the severity of the fuckup this is.

Hnrobert42 3y ago
It doesn’t take much for a machine to become irrevocably tainted, so the fact that they are doing a recall doesn’t, in and of itself, say much about the magnitude. Do you have some other data to substantiate your ire or are you just piling on?
- fsh 3y ago
  From the security advisory: > The vulnerability stemmed from incomplete input validation of user supplied .tar files as it pertains to the names of the files contained within the archive. Consequently, a remote attacker could format file names in a particular manner that would result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. I would not be comfortable to continue using a product that contained such an egregious flaw.
  - 8organicbits 3y ago
    Improper input validation chained to command injection? Those are quite common unfortunately.
chrisandchris 3y ago
So you will never buy a car because every manufacturer at some point already fucked something up with accelerate/break which means none of these can be trusted anymore?