https://openwrt.org/advisory/2020-01-31-1
After I read that, I removed openwrt on an old mips wifi router I had been using for years and moved to a fanless x86_64 running a minimal normal distro, set up via nmcli.
You switched systems for this? Sure, they could have done defense in depth (not unlike Debian, which also relies on signatures), but this was a bug in signature verification and... Honestly, how would someone even exploit this?
And then they can wait for the targets to update. They can do that pretty cheaply and over the 3 years and two major releases the broken opkg shipped on, just collect victims. That's what a lot of people in a lot of different countries are paid to do for a living.
Fixed that for you.
CVE-2019-3462 Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.
[0] https://www.cvedetails.com/vulnerability-list/vendor_id-23/p...
Edit: many of the CVEs for apt-get are in the "bad pki" class, all of them are "severe" as they allow malicious code execution:
CVE-2009-1358 apt-get does not check for the correct error code from gpgv
CVE-2011-1829 APT does not properly validate inline GPG signatures
CVE-2011-3634 APt accepts connections when the certificate host name fails validation
CVE-2014-0478 APT does not properly validate source packages, allow installation of Trojan horse packages by removing the Release signature.
etc etc.
Facts of life: all software contain an uncountable number of severe vulnerabilities. It is unfair to single-out openwrt IMHO.
The CVE you mention is about the transport part, it's not easy to get right and everything that goes on the network is at some risk of that. Still that seems a different kind of implication than nobody checked if packages could be tampered successfully for 3 years and afterwards nobody changed the infrastructure.
Then no infrastructure changes as a reaction to what happened? Like I said good for them, the PR mentions they will get some funding this is the kind of thing they can spend it on.
1) Still no dnssec on archive.openwrt.org 2) Still no tls on archive.openwrt.org
Those together mean you can poison the dns for it and it will download packages from your fake site. And...
3) Problem was introduced Feb 2017, nobody checked tampered packages were still rejected until 2020.
With 3) it means anyone can put whatever they want in the fake packages and the OS will install them.
I don't need much from my router but I need it to be secure. So I got rid of openwrt the next week.
You'll notice many other package management software do the exact same thing.
In any case, this is based on what other package management software does. I don't know if this is indeed the case.
https://openwrt.org/advisory/2020-01-31-1
A bug in the package list parse logic of OpenWrt's opkg fork caused the package manager to ignore SHA-256 checksums embedded in the signed repository index, effectively bypassing integrity checking of downloaded .ipk artifacts.
Is there a normal distro that is already set up similar to OpenWRT out of the box?
This has two mini PCI cards for wifi, one for 2.4GHz and one for 5GHz, they don't reach comparable speeds but it is very reliable. It also has 128GB msata SSD mini PCI.
Once Linux was installed, I was surprised nmcli + firewalld is really powerful now, I could set up a multizone AP with two mini PCI cards and Ethernet routing in a couple of hours googling, and it worked stably and just how I intended. For anything else, it's a normal Linux box with the kind of normal storage and packages you don't get on commodity routers.
No, as the article says
>> Conservancy will help OpenWrt continue to thrive and grow as its new fiscal sponsor.
That's what I think they need, to resolve their security and testing issues.
> Inter zone forwarding rules are still not a thing
I can believe that firewalld is not there on some things, but for what I wanted to do, including VPN service, it worked out great. I was expecting it to be a much harder ride, it would have been a few years ago.
> so this issue alone to switch seems an overreaction to me.
When I realized for 3 years there had been no package security on my own box I had thought was in better defensible shape than running manufacturer firmware, I realized I had been living in a fantasy. You're free to make up your own mind.