Hacker News Reader

Comment by ashleyn | Hacker News Reader

Surely hope that isn't running a 24-year old Linux distribution...

Is there actually a bug that's remotely exploitable in the TCP stack, if you drop everything besides bound tcp ports in iptables?

Any time I see a customer using an ssh or apache version from ten years ago (different from the kernel, but the kernel doesn't give you version disclosure), the list of bugs is all like "if they use RewriteRule and the second URI parameter is echoed unfiltered into a Location header by the application code and it's on Windows then you can do something actually interesting. The standard services' standard feature set is annoyingly boring when outdated ... most of the time.

Predictable sequence numbers would be my first worry, but with TLS and SSH being the main protocols of relevance, it doesn't really matter if you can send off-path traffic into a TCP connection.

I assumed myself there must be a lot of root privilege vulnerabilities in Apache, but it appears there isn't a single one:

https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

All the above seem to be in other Apache products. I think the fact that Apache doesn't run as root helps to mitigate these risks. Having said that, I have had a server compromised (about 20 years ago), through apache, suexec and a vulnerable cgi script, so I think it's best to be paranoid about security. I don't even see suexec on my current ubuntu 20.04 server (I used to just delete it).

Don't get me wrong, I don't mean to recommend running ancient software and not caring about security! It was rather out of curiosity: for the past 20-something years, which is no guarantee for the future (especially with software getting more complex than ever), would there be a blanket issue if you follow best practices in general (like dropping ports in iptables if you don't need them), or is it only specific circumstances like if you use a found-to-be-vulnerable function like for filename sanitisation? I don't know of any blanket linux/apache compromises off the top of my head, but there very well might be some.

From my perspective, there seems to be a lot more vulnerabilities found today than 20 years ago, so I don't think it's wise to have an unpatched 24 year old kernel or web server.

https://serialport.org/servers/cobalt/cobalt-raq-3/#specs

Originally it was 2.2

I had one of these for my first dedicated server. I kept up with the vendor's updates but it still was compromised. So I hope it wasn't running a 24-year old Linux distribution 24 years ago.

If it were, it could be any of these hot commodities: https://soft.lafibre.info/#year1999

Reply on news.ycombinator.com