News for hackers. Stuff that matters.

A comment on Critical vulnerability of NPM package macaddress. Parent comment

Re:Critical vulnerability of NPM package macaddress by Mister_Snuggles on Monday June 11, 2018 @10:38AM (#17284575)
Don't forget the just-as-bad-but-maybe-worse version for the generic Unix[0] platform. The Mac OS X version[1] is equally bad.

Ironically, I don't see this problem in the Windows version[2].

[0] https://github.com/scravy/node-macaddress/blob/dd079620d11c9...

[1] https://github.com/scravy/node-macaddress/blob/dd079620d11c9...

[2] https://github.com/scravy/node-macaddress/blob/dd079620d11c9...

[ Parent | on HN ]
Re:Critical vulnerability of NPM package macaddress by koolba on Monday June 11, 2018 @10:48AM (#17284677)
I think the Windows code may be broken as well though for entirely different reason. It doesn't handle overlapping names of network interfaces. It searches for the first occurrence of the text of iface[1] in the output and then returns the next macaddress-ish text it finds.

That means "Local Area Connection" will also match "Local Area Connection 2", "Local Area Connection 3", etc and the sort order of the ipconfig command will determine which one you will return.

[1]: https://github.com/scravy/node-macaddress/blob/dd079620d11c9...

[ Parent | on HN ]