4 ms·
Node team: you're censoring the original ticket, which is unwise IHMO. Your approach makes it impossible for an honest sysadmin to quickly find a way to block
by jph 13y ago
Node team: you're censoring the original ticket, which is unwise IHMO.
Your approach makes it impossible for an honest sysadmin to quickly find a way to block the attack using a firewall, but your approach doesn't stop an attacker from building an exploit based on the public commit.
Someone will come up with a proof of concept exploit quickly, and post it, probably here.
Please do the right thing: un-censor the GitHub ticket so we can understand what's happening.
- xs_kid 13y agoPoC is in codebase, it was published as a test-case for the fix.
- jkrems 13y agoUnfortunately that test-case passes against 0.8.25 as well. So I'm not quite convinced it can be used reliably to reproduce the problem.
- ak217 13y agoUnsurprising because the new streams API, which is responsible for this bug, was introduced in node 0.10. Try with earlier 0.10 versions instead.
- jkrems 13y agoWell, in that case lets add confusion about affected versions to the list of things being suboptimal about this whole thing: http://blog.nodejs.org/2013/10/18/node-v0-8-26-maintenance/ http://blog.nodejs.org/2013/10/18/node-v0-8-26-maintenance/ - the same warning about the same error and they did backport the fix to 0.8: https://github.com/joyent/node/commit/653d4db71f569ddc87a0bc21f5ecc5ceaf37f932 https://github.com/joyent/node/commit/653d4db71f569ddc87a0bc...
- ak217 13y agoYou're right, that is confusing. I'm not sure how it's exploitable in 0.8.
- benatkin 13y agoI'm sure they're well aware of this argument. > Your approach makes it impossible for an honest sysadmin to quickly find a way to block the attack using a firewall, but your approach doesn't stop an attacker from building an exploit based on the public commit. This is unfair. You're implying that sysadmins don't have access to programming resources, but that attackers do, without actually coming out and saying it. Once it's expressed this way, it seems wrongheaded. The phrase "script kiddies" comes out of attackers doing a lot without knowing much about programming. There are many sysadmins who code, and many attackers who don't. Furthermore, I think attackers are more likely to act alone than sysadmins, who often have developers working with them whom they can ask to help. Finally, as far as I can tell this is self-censorship. The people who created the ticket participated in the decision to hide it, or aren't loudly objecting to it. This type of "censorship" is not to be confused with more serious forms of censorship.
- dysinger 13y agohttps://github.com/dysinger/node-schadenfreude https://github.com/dysinger/node-schadenfreude