7 ms·

What are the possible implications?

tptacek 15y ago
You can safely trust me on this. Also, if you're concerned, the patch is very straightforward, minimal, safe, and fairly unintrusive. It's not going to break anything. Just patch it.
- spindritf 15y ago
  I did, I never pretend to know better than the developers. Question was dictated more by curiosity.
  - tptacek 15y ago
    I understand and totally don't blame you for asking.
    - coderdude 15y ago
      This is all very dramatic and entertaining, and we all know you're the security expert, so why leave that comment here yet decline to elaborate?
      - tptacek 15y ago
        Don't you think there should be a term for the phenomenon where someone makes it more or less clear that they have said all they're going to say about something on a message board, and still people come out of the woodwork to write comments cajoling them into saying more? I'm not complaining. It doesn't happen to me that often. Way more often, it's someone complaining about some anonymous employer or service provider and 20 people writing comments about how it's irresponsible for them not to say who it was. But it's the same kind of annoying every time. Maybe the term ought to be in German. German works great for concepts like this. Why did I leave the comment? Because it's hard to patch server software and people will often wait on patches until maintenance windows (advise you not do that this time) or take some time to figure out if they're affected. Especially with Apache, where oftentimes you aren't affected because the bug is in some random module most people don't use.
        Karunamon 15y ago
        > Don't you think there should be a term for the phenomenon where someone makes it more or less clear that they have said all they're going to say about something on a message board, and still people come out of the woodwork to write comments cajoling them into saying more? Don't take this the wrong way, but I think it was the tone of the response. I.e. "What are the implications of this?" "It's a bad bug, patch it ASAP" "....." It's the kind of non-response one would expect from a management type to a low level engineer. Somewhat odious to the average hacker, in other words. (I could be COMPLETELY off the mark here, and if so, please disregard this entire message)
        Robin_Message 15y ago
        Given how much Thomas contributes to this community, it seems fair to give him the benefit of the doubt and assume he has good reasons to say no more than what he has said. Also, this comment alone probably counts for thousands of dollars worth of value to people running business on nginx. Thanks Thomas. As to the average hacker, yes we want to know everything, but there are valid reasons not to be told everything. In this case, the information given is useful and sufficient, and the implications of what he said and how he said it are very clear indeed.
        grabastic 15y ago
        I think everyone has given him the benefit of the doubt, but this particular thread could have been much shorter if tptacek had just explicitly stated, "It's important and I won't help attackers by elaborating on the details." If that's not made clear then it's only natural for someone to ask for the specifics.
        ajross 15y ago
        Oh for goodness sake: google "responsible disclosure" and sit tight.
        kgen 15y ago
        A sentence about how severe the problem is and how many people it practically affects wouldn't have hurt.
- IgorPartola 15y ago
  Hopefully Red Hat, Debian, FreeBSD, etc. maintainers are reading this.
  - axk 15y ago
    Both FreeBSD ports have been already updated.
  - logic 15y ago
    Red Hat Bugzilla is tracking this for both RHEL (EPEL) and Fedora: Master tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=803856 https://bugzilla.redhat.com/show_bug.cgi?id=803856 EPEL: https://bugzilla.redhat.com/show_bug.cgi?id=803859 https://bugzilla.redhat.com/show_bug.cgi?id=803859 Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=803858 https://bugzilla.redhat.com/show_bug.cgi?id=803858 RPMs for 1.0.14 are available in koji at those second two links, or you can grab it via "yum --enablerepo=updates-testing update nginx" once the mirrors all pick it up.
- deleted 15y ago
  [deleted]
- deleted 15y ago
  [deleted]
rdl 15y ago
In Soviet Russia, your SSL private key becomes public key. (the private key is held in memory by the nginx process. If you can dump memory, you can dump key) (you may also want to generate a new key and get a new certificate if you use nginx, concurrent with patching this...)
- some32 15y ago
  You can't dump arbitrary memory with that bug. If you're very lucky and backend server already hacked or have holes, you can get some random part of previously send responce.

You can safely trust me on this. Also, if you're concerned, the patch is very straightforward, minimal, safe, and fairly unintrusive. It's not going to break anything. Just patch it.

spindritf 15y ago
I did, I never pretend to know better than the developers. Question was dictated more by curiosity.
- tptacek 15y ago
  I understand and totally don't blame you for asking.
  - coderdude 15y ago
    This is all very dramatic and entertaining, and we all know you're the security expert, so why leave that comment here yet decline to elaborate?
    - tptacek 15y ago
      Don't you think there should be a term for the phenomenon where someone makes it more or less clear that they have said all they're going to say about something on a message board, and still people come out of the woodwork to write comments cajoling them into saying more? I'm not complaining. It doesn't happen to me that often. Way more often, it's someone complaining about some anonymous employer or service provider and 20 people writing comments about how it's irresponsible for them not to say who it was. But it's the same kind of annoying every time. Maybe the term ought to be in German. German works great for concepts like this. Why did I leave the comment? Because it's hard to patch server software and people will often wait on patches until maintenance windows (advise you not do that this time) or take some time to figure out if they're affected. Especially with Apache, where oftentimes you aren't affected because the bug is in some random module most people don't use.
      - Karunamon 15y ago
        > Don't you think there should be a term for the phenomenon where someone makes it more or less clear that they have said all they're going to say about something on a message board, and still people come out of the woodwork to write comments cajoling them into saying more? Don't take this the wrong way, but I think it was the tone of the response. I.e. "What are the implications of this?" "It's a bad bug, patch it ASAP" "....." It's the kind of non-response one would expect from a management type to a low level engineer. Somewhat odious to the average hacker, in other words. (I could be COMPLETELY off the mark here, and if so, please disregard this entire message)
        Robin_Message 15y ago
        Given how much Thomas contributes to this community, it seems fair to give him the benefit of the doubt and assume he has good reasons to say no more than what he has said. Also, this comment alone probably counts for thousands of dollars worth of value to people running business on nginx. Thanks Thomas. As to the average hacker, yes we want to know everything, but there are valid reasons not to be told everything. In this case, the information given is useful and sufficient, and the implications of what he said and how he said it are very clear indeed.
        grabastic 15y ago
        I think everyone has given him the benefit of the doubt, but this particular thread could have been much shorter if tptacek had just explicitly stated, "It's important and I won't help attackers by elaborating on the details." If that's not made clear then it's only natural for someone to ask for the specifics.
        ajross 15y ago
        Oh for goodness sake: google "responsible disclosure" and sit tight.
      - kgen 15y ago
        A sentence about how severe the problem is and how many people it practically affects wouldn't have hurt.
IgorPartola 15y ago
Hopefully Red Hat, Debian, FreeBSD, etc. maintainers are reading this.
- axk 15y ago
  Both FreeBSD ports have been already updated.
- logic 15y ago
  Red Hat Bugzilla is tracking this for both RHEL (EPEL) and Fedora: Master tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=803856 https://bugzilla.redhat.com/show_bug.cgi?id=803856 EPEL: https://bugzilla.redhat.com/show_bug.cgi?id=803859 https://bugzilla.redhat.com/show_bug.cgi?id=803859 Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=803858 https://bugzilla.redhat.com/show_bug.cgi?id=803858 RPMs for 1.0.14 are available in koji at those second two links, or you can grab it via "yum --enablerepo=updates-testing update nginx" once the mirrors all pick it up.
deleted 15y ago
[deleted]
deleted 15y ago
[deleted]

rdl 15y ago

In Soviet Russia, your SSL private key becomes public key. (the private key is held in memory by the nginx process. If you can dump memory, you can dump key) (you may also want to generate a new key and get a new certificate if you use nginx, concurrent with patching this...)

some32 15y ago
You can't dump arbitrary memory with that bug. If you're very lucky and backend server already hacked or have holes, you can get some random part of previously send responce.