7 ms·
Windows TCP/IP Remote Code Execution Vulnerability
- gjvc 2y ago"Systems are not affected if IPv6 is disabled on the target machine."
- snvzz 2y agoNotably enabled by default. And adoption seems to be at 45%[0]. 0. https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html
- LegionMammal978 2y agoIsn't that number largely driven by the adoption of mobile phones, on their own cellular networks? Which wouldn't necessarily correlate with IPv6 access from Windows machines in particular.
- sulandor 2y agoyes. though all windows machines seem affected
- HereIGoAgain 2y agoYup, I've been waiting to see someone point this detail out in response to the rosy adoption numbers.
- sylware 2y agoIn my country, only very few ISPs, including mobile ones, do _NOT_ provide native IPv6... Actually, I was planning to switch off IPv4 but some SMTP servers are still IPv4 only and few other services (msft github for instance).
- sgjohnson 2y agoUnfortunately, disabling IPv4 is not a viable option, unless you run IPv4 literal address translation layer (464XLAT on the server side and CLAT on the clients). Many sites still do not support IPv6, which is a great shame, but slowly but surely we’re getting there. I tried 464XLAT on my home network, for the most part it worked flawlessy, aside from some IoT devices that don’t support v6 at all or are not LAT aware. So dual stack it is.
- sylware 2y agoAs I said, really not that many, to a point I was about to turn off IPv4. Ofc, it depends on your usage. But what's very surprising are those Big Tech sites, with billions of $ and still IPv4 only, like msft github (and github has still its core functions working with noscript/basic (x)html browsers). What is really bothering me is the admin of the mail server of my medical insurance company: IPv4... but that's not what is the most annoying, the most annoying: it is not white listing its client SMTP servers/client emails... this is another level of bad.
- nullindividual 2y agoMicrosoft does not test Windows without IPv6 enabled and encourages customers to keep it enabled even when IPv6 is not deployed on a given network. https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-ipv6-in-windows#summary https://learn.microsoft.com/en-us/troubleshoot/windows-serve... https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/a-5-second-boot-optimization-if-you-ve-disabled-ipv6-on-windows/ba-p/257498 https://techcommunity.microsoft.com/t5/core-infrastructure-a...
- Borg3 2y agoHmm terrible CVE published by Microsoft. Oh well, what I could expect.. Anyway, question is.. If this is mitigated by disabling IPv6 it means its IPv6 stack only issue exploit? IPv4 is safe?
- GoblinSlayer 2y agoYep, new feature, new buffer overflows :)
- mrinfinitiesx 2y agoThis should be interesting to watch unfold.
- mylastattempt 2y agoThe CVE has been discovered by a security researcher/firm, rather than being found in the wild. Without technical details or a PoC being publiclya available, I doubt this will amount to more than just another starting point for someone to developer a new exploit. In a year or so it might show up in your Metasploit bundle.
- jakeogh 2y agoIts a odd to take any assertion that "it wasn't seen in the wild" as if in the opposing frame(s) it wasn't "our best technique for over a decade". Like any valuable secret, the incentives are in the other direction on both sides.
- sidewndr46 2y agoI don't think that is a realistic conclusion. If one group found it, we can assume that there exists at least one other group that is capable of finding. It therefore is not unrealistic to believe this has seen limited exploitation by sufficiently motivated actors.
- zer0c00ler 2y ago[dead]
- acidictadpole 2y ago> The CVE has been discovered by a security researcher/firm, rather than being found in the wild. The researcher/firm was the one that disclosed it, but I don't feel like you could conclusively say that the exploit isn't in the wild.
- deleted 2y ago[deleted]
- 2y ago
- wokwokwok 2y agoOn the bright side, anyone who’s looking for a target to exploit can just go back and look at the people who suffered crowdstrike related outages… Yay. :p
- ricc 2y agoThe page does not seem to be loading for me?
- deleted 2y ago[deleted]
- sylware 2y ago"javascript is required to load this page" Is there a CVE database noscript/basic (x)html reader?
- cebert 2y agoIt’s 2024, all major sites require JS to load properly.
- Suzuran 2y agoThis sounds like a problem that needs solved, not a club to beat people with when they complain about it.
- progforlyfe 2y agowithout a financial or regulatory incentive, it will remain unsolved. Companies do not care about catering to the 0.01% with JS disabled.
- sylware 2y agoYep, regulatory, like EU did to apple: recuring fines of billions of $. It seems to be the only way.
- rolph 2y agoIt’s 2024, all major sites [Have Been Engineered To] require JS to load properly.
- sylware 2y agoYep, tons of them were working more than fine in noscript/basic (x)html. This is just some big tech-cracy abusing the script kiddy who is in all of us, poisoning us with massive kludges which obsviously only them could maintain and control, using it as trojan horse for all their toxic tech.
- applied_heat 2y agoDoes it affect windows 7 and XP systems?
- GoblinSlayer 2y agoThey provide updates to Windows Server 2008 SP2 and Windows Server 2008 R2 SP1.
- Technetium 2y agoIPv6 was introduced in XP, so it's probably safe to assume vulnerability there as well. They don't provide updates pre-2008 anyway, so we'll never know until a PoC comes out for testing. Disable IPv6 just in case you do have one of those antiques connected to a network.
- Borg3 2y agoWindows XP does NOT have IPv6 installed by default.
- Technetium 2y agoTurns out you're right, thanks for the correction! It's been so incredibly long since I used XP that I forgot it does need to be installed. It was introduced as a default in Server 2008 & Vista per https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-ipv6-in-windows https://learn.microsoft.com/en-us/troubleshoot/windows-serve...
- jftuga 2y agoHere is the commentary / explanation from Ed, the Low Level Learning Youtube channel: https://www.youtube.com/watch?v=t5cAT2l_G44 https://www.youtube.com/watch?v=t5cAT2l_G44
- babarmustafa575 2y ago[flagged]
- deleted 2y ago[deleted]
- HereIGoAgain 2y agoJokes on them, i've had IPv6 disabled at the adapter level for years.