Windows TCP/IP Remote Code Execution Vulnerability | Hacker News Reader

Windows TCP/IP Remote Code Execution Vulnerability

msrc.microsoft.com

125 pointsgjvc60 comments

On the bright side, anyone who’s looking for a target to exploit can just go back and look at the people who suffered crowdstrike related outages…

Yay. :p

This should be interesting to watch unfold.

The CVE has been discovered by a security researcher/firm, rather than being found in the wild. Without technical details or a PoC being publiclya available, I doubt this will amount to more than just another starting point for someone to developer a new exploit. In a year or so it might show up in your Metasploit bundle.

Its a odd to take any assertion that "it wasn't seen in the wild" as if in the opposing frame(s) it wasn't "our best technique for over a decade".

Like any valuable secret, the incentives are in the other direction on both sides.

I don't think that is a realistic conclusion. If one group found it, we can assume that there exists at least one other group that is capable of finding. It therefore is not unrealistic to believe this has seen limited exploitation by sufficiently motivated actors.

> The CVE has been discovered by a security researcher/firm, rather than being found in the wild.

The researcher/firm was the one that disclosed it, but I don't feel like you could conclusively say that the exploit isn't in the wild.

Yes, it's sometimes hard to keep in mind that vulnerabilities don't just materialze into existence when they're first publicized. It's a differnt picture, everyone is vulnerable all the time.

Every Windows-based business LAN or industrial machine I know still has IPv6 disabled. Most other targets are too low value for people to bother.

IPv6 actually disabled or meerly inactive because there's no router advertisements on the LAN?

I suspect more of the second than the first. If it's just inactive, a compromised host can often broadcast a router advertisement or perhaps use local net addresses to compromise other hosts. A well prepared network would block ipv6 traffic on their switches, it they don't want it, but that's a big investment in capable switches.

It's a registry setting. https://learn.microsoft.com/en-us/troubleshoot/windows-serve...

Which says:

> You cannot completely disable IPv6 as IPv6 is used internally on the system for many TCPIP tasks. For example, you will still be able to run ping ::1 after configuring this setting.

I'd be concerned their workaround is just limiting it into a local vulnerability that spyware, etc will abuse on all the systems that end up not patched because they used the workaround..

When spyware holds your ass, it already has everything on you and doesn't need any vulnerability.

> When spyware holds your ass, it already has everything on you and doesn't need any vulnerability.

..because it uses one of the available local escalation tricks, where sending RA to ::1 could be one of those if that is a thing.

I mean 'disabled in network adapter connection properties'. If you're already using IPv4 there's no reason for the extra complications of leaving IPv6 enabled.

> If you're already using IPv4 there's no reason for the extra complications of leaving IPv6 enabled.

That’s just flat out wrong. No pure IPv6 deployments exist on endpoints in practice. Only in internal networks. You either run pure v4, or dual stacked v4+v6.

IPv6 is gaining some pretty solid adoption these days, but it’s not there yet. Disabling it is holding back the deployment of it, and is a problem by itself.

The context ('business LAN or industrial machine') referred to internal networks. What happened there doesn't really effect IPv6 adoption.

That’s definitely not the norm. IPv6 is enabled by default and it’s not recommended to disable it. Only really locked down places that are ignoring recommendations would have it disabled.

Whether it’s exposed to the Internet is another question, but pretty much everyone has a firewall to at least stop passive scans.

We do it in our 10k+ environment.

It seems that this can be triggered before the packet reaches the firewall.

https://www.bleepingcomputer.com/news/microsoft/zero-click-w...

I meant a network level firewall at the perimeter, but this is good information to know you can’t rely on the Windows firewall.

> Every Windows-based business LAN or industrial machine I know still has IPv6 disabled.

Which is against Microsoft's recommendations:

> Internet Protocol version 6 (IPv6) is a mandatory part of Windows Vista and Windows Server 2008 and newer versions. We do not recommend that you disable IPv6 or its components. If you do, some Windows components may not function.

* https://learn.microsoft.com/en-us/troubleshoot/windows-serve...

Microsoft doesn't even listen to their own recommendations. Why would anybody else?

"javascript is required to load this page"

Is there a CVE database noscript/basic (x)html reader?

It’s 2024, all major sites require JS to load properly.

This sounds like a problem that needs solved, not a club to beat people with when they complain about it.

without a financial or regulatory incentive, it will remain unsolved. Companies do not care about catering to the 0.01% with JS disabled.

Yep, regulatory, like EU did to apple: recuring fines of billions of $. It seems to be the only way.

It’s 2024, all major sites [Have Been Engineered To] require JS to load properly.

Yep, tons of them were working more than fine in noscript/basic (x)html.

This is just some big tech-cracy abusing the script kiddy who is in all of us, poisoning us with massive kludges which obsviously only them could maintain and control, using it as trojan horse for all their toxic tech.

I forgot... "toxic tech"... and their backdoors...

This

Using the internet in 2024 without JS, and commenting on things not working, is borderline delusional behaviour.

I can't access it via my Gopher client.

Yep, angular is now used for basic operation of internet, just as planned.

If a website can't manage to at least display text and images without needing JS it's just bad design. Good design degrades gracefully and prioritizes making the essential data accessible to as many people as possible

aka sane common sense

thinking that including 3 trillion billion js libraries is necessary to put some text out there in a nice way is also pretty delusional, yet here we are

With javascript enabled, it's just looks like a paginated slide show and each page is a spinning loading circle. You're not missing much.

Previously there was https://cve.circl.lu/cve/CVE-2024-38063

Had a look, I could not get anything about it. Maybe there will be noscript/basic (x)html sites with some sort of proof of concept?

Apparently surfraw has an elvis for it: https://gitlab.com/surfraw/Surfraw/-/wikis/current-elvi

Does it affect windows 7 and XP systems?

They provide updates to Windows Server 2008 SP2 and Windows Server 2008 R2 SP1.

IPv6 was introduced in XP, so it's probably safe to assume vulnerability there as well. They don't provide updates pre-2008 anyway, so we'll never know until a PoC comes out for testing. Disable IPv6 just in case you do have one of those antiques connected to a network.

Windows XP does NOT have IPv6 installed by default.

Turns out you're right, thanks for the correction! It's been so incredibly long since I used XP that I forgot it does need to be installed. It was introduced as a default in Server 2008 & Vista per https://learn.microsoft.com/en-us/troubleshoot/windows-serve...

The page does not seem to be loading for me?

Here is the commentary / explanation from Ed, the Low Level Learning Youtube channel:

https://www.youtube.com/watch?v=t5cAT2l_G44

Jokes on them, i've had IPv6 disabled at the adapter level for years.

"Systems are not affected if IPv6 is disabled on the target machine."

Notably enabled by default.

And adoption seems to be at 45%[0].

0. https://www.google.com/intl/en/ipv6/statistics.html

Isn't that number largely driven by the adoption of mobile phones, on their own cellular networks? Which wouldn't necessarily correlate with IPv6 access from Windows machines in particular.

yes. though all windows machines seem affected

Yup, I've been waiting to see someone point this detail out in response to the rosy adoption numbers.

In my country, only very few ISPs, including mobile ones, do _NOT_ provide native IPv6...

Actually, I was planning to switch off IPv4 but some SMTP servers are still IPv4 only and few other services (msft github for instance).

Unfortunately, disabling IPv4 is not a viable option, unless you run IPv4 literal address translation layer (464XLAT on the server side and CLAT on the clients). Many sites still do not support IPv6, which is a great shame, but slowly but surely we’re getting there.

I tried 464XLAT on my home network, for the most part it worked flawlessy, aside from some IoT devices that don’t support v6 at all or are not LAT aware. So dual stack it is.

As I said, really not that many, to a point I was about to turn off IPv4.

Ofc, it depends on your usage.

But what's very surprising are those Big Tech sites, with billions of $ and still IPv4 only, like msft github (and github has still its core functions working with noscript/basic (x)html browsers).

What is really bothering me is the admin of the mail server of my medical insurance company: IPv4... but that's not what is the most annoying, the most annoying: it is not white listing its client SMTP servers/client emails... this is another level of bad.

Microsoft does not test Windows without IPv6 enabled and encourages customers to keep it enabled even when IPv6 is not deployed on a given network.

https://learn.microsoft.com/en-us/troubleshoot/windows-serve...

https://techcommunity.microsoft.com/t5/core-infrastructure-a...

Hmm terrible CVE published by Microsoft. Oh well, what I could expect..

Anyway, question is.. If this is mitigated by disabling IPv6 it means its IPv6 stack only issue exploit? IPv4 is safe?

Yep, new feature, new buffer overflows :)

Reply on news.ycombinator.com