Conversation

Notices

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Friday, 09-Aug-2024 03:34:38 JST Kevin Beaumont

   Before anybody starts to get too excited about the OpenVPN vulnerabilities Microsoft are doing a publicity tour for, they need authentication and are client side - so nothing particularly risky.

   https://www.microsoft.com/en-us/security/blog/2024/08/08/chained-for-attack-openvpn-vulnerabilities-discovered-leading-to-rce-and-lpe/

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Friday, 09-Aug-2024 03:37:27 JST Kevin Beaumont

     in reply to

     Press will probably largely run with the opening few sentences, but if you keep reading your interest will change as the risk changes substantially.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Friday, 09-Aug-2024 03:48:16 JST Kevin Beaumont

     in reply to

     To be clear about this, there are 4 CVEs - 3 are for the OpenVPN *client* on Windows, and 1 is for the Android client.

     I don’t know why the MS blog post is going on about binaries on millions of routers, as those are the OpenVPN *server* - which is different.

     The RCE one here is against the client, not server, and needs you to be on a VPN with a compromised host doing SMB/RPC traffic back to your system (you have Windows Firewall, though) and know creds on your system.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Friday, 09-Aug-2024 03:51:32 JST Kevin Beaumont

     in reply to

     It’s valid research and people should apply updates as usual, ie no panic.

     It would be good if Microsoft could turn their researchers attention to their own products, where gaping holes exist in things like legacy (still enabled) components in Windows OS, Office etc etc.

     Or maybe just look at the long list of known issues in SmartScreen, DWM etc etc rather than waiting for Kaspersky to tell them after people have already been owned.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Friday, 09-Aug-2024 04:52:27 JST Kevin Beaumont

     in reply to

     Microsoft incorrectly call these vulnerabilities “zero-days” repeatedly.

     They aren’t - patches have been available since earlier this year and exploitation was never detected in the wild.

   • Embed this notice
     ludiofines (ludiofines@cyberplace.social)'s status on Friday, 09-Aug-2024 16:58:09 JST ludiofines

     @GossiTheDog another linkedin ban incoming?