3 ms·
Ah, there's the other shoe:) > optional sources, that have to be activated explicitly. So only locally exploitable, and you have to enable an optional feature
by yjftsjthsd-h 2y ago
Ah, there's the other shoe:)
> optional sources, that have to be activated explicitly.
So only locally exploitable, and you have to enable an optional feature? That's ... honestly better than I was worried that it might be
- immibis 2y ago> always tries to connect
- MattPalmer1086 2y agoThe fix is to make it optional. But yeah, I was anticipating something quite a bit worse.
- dgacmu 2y agoNo. Local but it always tries to connect and the deamon to which it tries to connect is optional, which means that the default is attackable. An attacker can run their own program on the port and send bad strings that will cause an overflow.
- yjftsjthsd-h 2y agoOh, I see, thanks. > Therefore, the default behavior of atop is now not to connect to the TCP port at all. I missed that now it defaults to not connecting.
- mvdtnz 2y agoDid you stop reading at that sentence?
- yjftsjthsd-h 2y agoUnlikely, since the use of a local TCP part was later than the quoted sentence. Granted, I did skim, but after having it clarified and rereading, I think that introduction is misleadingly phrased and would benefit from clearer delineation of the previous vulnerable behavior and the fixed behavior.
- xyst 2y agoRight, the post on “rachelbythebay” was hinting at something much worse.
- brazzy 2y agoHow so? It was pretty clear from her second post that it's a local privilege escalation. And that is is, and otherwise fairly easily exploitable.
- natebc 2y agowell, the first post opened with "You might want to stop running atop" and followed with "Right now, I think it's probably best if you uninstall atop. I don't mean just stopping it, but actually keep it from being executed." Which does indeed hint at something much worse IMO. To be clear: I value rachaels opinion and contributions greatly. Maybe just these days I'm a little grounchy about panicky security people making us spend hours during the middle of the week uninstalling atop from hundreds of systems that wouldn't have been at risk from something like this.