4 ms·

They say that its fine to reboot but that there is no guarantee that you will land on an updated host. However, AWS does provide a script to run on Windows mac

by Corrado 12y ago

They say that its fine to reboot but that there is no guarantee that you will land on an updated host. However, AWS does provide a script to run on Windows machines which should tell you if that particular machine has the issue. I took a quick look at the script and deduced that it is indeed a Xen issue.

akerl_ 12y ago
It seems like providing a script that identifies if your system is vulnerable to an embargoed XSA would be a violation of the predisclosure list, since it would basically be pointing at what the issue was?
- wmf 12y ago
  How does one bit of information (vulnerable / not vulnerable) tell you what the vulnerability is?
  - akerl_ 12y ago
    It's not the results of the script that I'm referring to, it's the contents of the script. If I hand you code that can look at your system and determine something about it, you can look at what the code is doing and identify what it is looking at, which tells you where the vulnerability is. It becomes moderately harder if it's compiled code, but still not very difficult.
    - pfg 12y ago
      Unless the fixed version of Xen exposes some kind of signal to its VMs that says "Hi, I'm not affected!" - which then could be read by this script. I don't know if and how that's possible with Xen though.
    - x0x0 12y ago
      So make the code query an opaque EC2 api, instead of testing the machine. You could still find a machine that is vulnerable and one that isn't and attempt to find out what the difference is, but that's a much harder task.
      - akerl_ 12y ago
        True, and if that's the case, my concern is resolved. That said, if they were just checking software version or querying an Amazon API endpoint, I'd expect them to give out a tool or URL you could use that would give you the state for all your systems at once, rather than a script that you'd run on the machine itself.
- nraynaud 12y ago
  maybe just checking a version number or a compilation date? Indirect check?
rands3311 12y ago
This is not related to the scheduled reboot maintenance. The script that you are referring to has to do with a separate Windows networking driver and Xen.
- Corrado 12y ago
  Indeed, it appears as if you are correct [1]. This issue is with Windows Server 2012 R2 network drivers as is from Sep. 17, 2014. If you're interested in the script you can download it from that page. [1] http://aws.amazon.com/windows/2012r2-network-drivers/ http://aws.amazon.com/windows/2012r2-network-drivers/
devicenull 12y ago
Post the script? It seems they could easily hit the metadata service to determine if a machine is patched or not.

by Corrado 12y ago

akerl_ 12y ago

It seems like providing a script that identifies if your system is vulnerable to an embargoed XSA would be a violation of the predisclosure list, since it would basically be pointing at what the issue was?

wmf 12y ago
How does one bit of information (vulnerable / not vulnerable) tell you what the vulnerability is?
- akerl_ 12y ago
  It's not the results of the script that I'm referring to, it's the contents of the script. If I hand you code that can look at your system and determine something about it, you can look at what the code is doing and identify what it is looking at, which tells you where the vulnerability is. It becomes moderately harder if it's compiled code, but still not very difficult.
  - pfg 12y ago
    Unless the fixed version of Xen exposes some kind of signal to its VMs that says "Hi, I'm not affected!" - which then could be read by this script. I don't know if and how that's possible with Xen though.
  - x0x0 12y ago
    So make the code query an opaque EC2 api, instead of testing the machine. You could still find a machine that is vulnerable and one that isn't and attempt to find out what the difference is, but that's a much harder task.
    - akerl_ 12y ago
      True, and if that's the case, my concern is resolved. That said, if they were just checking software version or querying an Amazon API endpoint, I'd expect them to give out a tool or URL you could use that would give you the state for all your systems at once, rather than a script that you'd run on the machine itself.
nraynaud 12y ago
maybe just checking a version number or a compilation date? Indirect check?

rands3311 12y ago

This is not related to the scheduled reboot maintenance. The script that you are referring to has to do with a separate Windows networking driver and Xen.

Corrado 12y ago
Indeed, it appears as if you are correct [1]. This issue is with Windows Server 2012 R2 network drivers as is from Sep. 17, 2014. If you're interested in the script you can download it from that page. [1] http://aws.amazon.com/windows/2012r2-network-drivers/ http://aws.amazon.com/windows/2012r2-network-drivers/

devicenull 12y ago

Post the script? It seems they could easily hit the metadata service to determine if a machine is patched or not.