Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by amalcon on Thursday March 28, 2019 @01:39AM (#19509563)

In this specific case (I have never encountered a proposal quite this bad), the correct answer is probably "Give me the proof of concept code and about ten minutes, and I'll give you a version that works despite the patch." You're right about that. "No" is likely to bog down the discussion with "but Bob says it will work", and it's better to skip to the end.

I'm envisioning more of a middle-ground case, where the code is still obviously wrong but it's harder to cleanly demonstrate why.

[ Parent | on HN ]

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by tyldum on Thursday March 28, 2019 @02:19AM (#19509719)

Sometimes you need an interim solution. A decent organization will be able to manage them by replacing them with actual resolution.

Cisco has a bad track record in that regard and software in general.

My employer has reached a settlement with Cisco after buying their "firepower" solution which has been plagued with basic software and usability bugs.

[ Parent | on HN ]

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by mikevp on Friday March 29, 2019 @03:30PM (#19524780)

Ten minutes? How long does it take to type a user agent string into the curl command line?

In my case, a user agent string pretending to be Firefox is already part of my .curlrc, so it's no time at all, just grab the PoC code and fire away. (I've got commented out user-agent lines for a bunch of other browsers that I can uncomment as the need or mood strikes me.)

[ Parent | on HN ]

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by amalcon on Friday March 29, 2019 @09:17PM (#19526929)

I'm basically assuming five minutes to read the script, negligible time to change it, and another five to make sure it worked.

[ Parent | on HN ]