Programmer nerd talk

[PanthersATL]

Supposedly a CURL exploit is being announced tomorrow, and rumor is its kinda a big deal. Or not. More to come if true

[Sapper]

I guess either it didn’t happen, or it wasn’t a big deal?  I’m a programmer, just  never coded much in cURL, and I never heard much about news.

[Sapper]

 

here’s the vulnerability:

 

The curl vulnerability is a heap-based buffer overflow within hostnames of SOCKS5 proxies via the command-line flag. This happens due to curl switching to a local resolve mode if the name is too long.

Easily fixable.

 

 

[Sapper]

sorry for the formatting

[PanthersATL]

On 1/19/2024 at 5:04 PM, Sapper said:

I guess either it didn’t happen, or it wasn’t a big deal?  I’m a programmer, just  never coded much in cURL, and I never heard much about news.

Ended up not being a huge deal

[Davidson Deac II]

Speaking of exploits, this one is a big deal.  Ivanti is a huge player when it comes to remote access/working from home.  

Researchers say attackers are mass-exploiting new Ivanti VPN flaw | TechCrunch

 

Quote

Now data shows that one of the newly discovered flaws — CVE-2024-21893, a server-side request forgery flaw — is being mass exploited.