alt Hacker NewsHave companies been compromised because of this vulnerability? Ubuntu has an absolutely massive install base. The lack of notable incidents suggests that 9.8 might not reflect real-world well.
Maybe it's time for StealMyBitcoinV2…
Replies
If someone does a v2 let's hope they make sure it's actually exploitable when they set it up so they don't leave hundreds of people with the assumption that the cve is not a big deal when the CTF was just misconfigured and the system got pwned in less than 2 hrs after they fixed it
CVSS in general is not the best proxy for "real world impact". You could have a 10 on a software thats only deployed once and the impact would be tiny. In this case, multipath is not used that much (except by go).
I think it's less of a concern over the internet because the kind of packet necessary for the exploit tends to be filtered out, but it's pretty scary as an escalation mechanism from e.g. an end-user device to a core server.
Much like with PHP2Shell, it doesn't need to be utterly trivially exploitable to be a big concern.
Contrast this with: "The Gift of It's Your Problem Now"
We keep doing this to ourselves. Heads should roll at Ubuntu. Start that process right now? You can't. You see, nobody is directly available to sue. It does seem that nobody ever truly cared about that. The insecure codebase and tech debt shall continue to grow because that is the gift.
https://apenwarr.ca/log/20211229-the-gift-of-its-your-proble...
I think the official CTF is up here:
https://ubuntu.com/security
server: nginx/1.14.0 (Ubuntu)