HP iLO4 authentication bypass: curl -H "Connection: AAAAAAAAAAAAAAAAAAAAAAAAAAAAA" No, that's not a crash PoC. That's a full blown auth bypass. sscanf into fixed buffer overwrites a flag field that bypasses auth. Yes, really. https://airbus-seclab.github.io/ilo/SSTIC2018-Slides-EN-Backdooring_your_server_through_its_BMC_the_HPE_iLO4_case-perigaud-gazet-czarny.pdf …
-
Show this thread
-
Nobody audits anything. Everything is insecure. *sscanf*. *s-fucking-scanf*. In a web server. I'm just going to start giving each device a /30 and sticking reverse proxies in front of everything. Let me guess: next the switch will have an IGMP code exec bug or something. Sigh.
14 replies 72 retweets 327 likesShow this thread -
Replying to @marcan42
I sometimes use sscanf still; I'm just not going to be using %s with it
1 reply 0 retweets 0 likes
Replying to @Myriachan
Even %s is "fine" if you can bound the input, but asking for trouble. But yeah, I meant the unbounded %s terribly broken usage.
9:06 AM - 19 Jun 2018
0 replies
0 retweets
0 likes
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.