The Harmless Pi-Hole Bug

https://www.kiyell.com/The-Harmless-Pihole-Bug/

by kiyell • 2 years ago

56 41 2 years ago

jeroenhd2• 2 years ago

This stuff is why CVE numbers are meaningless. "Someone can see the temperature of your server if they can get into your home network" is barely a bug, let alone a security bug.

This is just generating CVE numbers for the sake of it.

ziddoap6• 2 years ago

If you don't assign CVE numbers to every security-related flaw, no matter how minor the flaw may be, you must come up with a way to draw the line on what flaws get CVEs and what ones don’t. That would be worse in pretty much every respect.

As it is now, I can look at a CVE and determine for myself and my organization whether it something we need to care about. I’d rather that decision stay in my hands, not someone else’s.

chgs2• 2 years ago

So you are happy to have 1 million cves to look for per year per product?

Unless there’s a minimum standard it becomes noise, and the real CVEs are lost.

shawnz• 2 years ago

If you don't assign CVE numbers to every security-related flaw, no matter how minor the flaw may be, you must come up with a way to draw the line on what flaws get CVEs and what ones don’t.

That's already the case now, since there's no perfectly objective way to decide whether a bug is even security related or not.

This is just an example of where that already existing subjective distinction was applied in a way that not everyone agreed with. It's an unavoidable problem that is going to happen once in a while.

It doesn't mean that CVEs are useless and it doesn't necessarily mean we need to be more liberal about what warrants a CVE either.

jgalt212• 2 years ago

I can look at a CVE and determine for myself and my organization whether it something we need to care about.

Yes, but one can envision a scenario where everything gets a CVE number and you, or members of your team, spend an inordinate amount of time looking up CVE numbers. Then along comes a service that you have to pay for that scores each CVE number for you. Due to any lack of discretion (in a database maintained by "experts"), you'll pay with your time, or your money.

suprjami4• 2 years ago

I can look at a CVE and determine for myself and my organization whether it something we need to care about.

Except it doesn't work like this.

A security scanner will include a CVE. People want no red flags on the security scanner. They don't care what the CVE is, they just want red mark go away.

The attitude to accepting useless crap as a CVE is diluting what an important CVE actually is.

mjlee• 2 years ago

Not exactly that, someone can change the unit used to display the temperature for authenticated users.

VyseofArcadia• 2 years ago

Now we just sit back and wait for the side channel attack where someone figures out how to use temperature changes to exfil data.

sokoloff• 2 years ago

https://xkcd.com/1172/

tomschlick• 2 years ago

Yeah this is generating CVE numbers for resume clout.

iforgotpassword• 2 years ago

Maybe this is actually a good thing. Check a few of the cves they found and if it's things like this, you're dealing with a clown. I'd feel ashamed requesting to get a cve assigned for something like that.

omoikane• 2 years ago

In this particular case they probably should have reported it as a regular bug and not as a vulnerability, but I am not sure this generalizes to CVE numbers being meaningless since I am not sure how often it happens.

jeroenhd2• 2 years ago

Most CVE numbers are useful, but there are enough meaningless ones that will set off commercial security scanners to extort a sale to make them unreliable enough that you need to dig into most of them (rather than just assume they're security risks and treat them with the correct priority). Annoyingly, there are also plenty of security bugs that don't make it through the CVE system.

In a perfect world, you should be able to treat a CVE number in a scan or bug report as something of importance, but in practice you need to filter out the "time protocol allows reading the time" class of CVEs as well. CVEs might as well be links to Github issues if they're treated like this.

suprjami4• 2 years ago

My favourite is CVE-1999-0524, people can tell the time set on your system with ICMP Timestamp messages.

Someone's added it to a commercial security scanner recently, so we have a lot of "severity 1" tickets to disable it.

Yes, severity 1 for something that's been there for 25 years. Very important CVE obviously.

https://nvd.nist.gov/vuln/detail/CVE-1999-0524

snapcaster• 2 years ago

I disagree, that's pretty easy to turn into a occupancy sensor. I think people need to get away from the "is this piece of information sensitive" in isolation and start thinking about it more like leaking bits. Leaking bits is bad, you don't know how a clever person might leverage them

Valectar• 2 years ago

There's a lot of discussion here in the comments on whether this can meaningfully be called a vulnerability if you can only "see the temperature of your server".

Setting aside that the vulnerability doesn't actually allow that, isn't this potentially a Spectre / Meltdown vulnerability? This is an unprotected endpoint that conditionally executes code taken from user input. If the branch predictor can be trained to speculatively execute arbitrary code from the input, information could be extracted via endpoint timing using a similar methodology to Spectre or Meltdown, right?

bongodongobob• 2 years ago

This is what annoys me about internal security teams. No, this doesn't make us vulnerable because it's in the DMZ, we have ACLs, it's behind a firewall, we have traffic monitoring, process monitoring, MFA, geofences, etc etc. Just because there's a possibility this could be exploited in some convoluted way in a targeted attack doesn't mean all the other walls we have stood up around this are suddenly useless. I'm constantly pestered and forced to waste my time explaining that your little CVE scanner tool is not the end all for our security posture.

Not to snap at you, but I'm forced to deal with these "what if" scenarios weekly and it drives me nuts. I know the security guys have a job to do, but I feel like half of their job is just trying to drum up scary looking things to justify their employment.

jijji• 2 years ago

where is the bug tho... the author is unable to do any exploit because the input variable is correctly sanity checked.... again, where is the "bug" or how is this a bug?

hoseja• 2 years ago

Behold, professional bug bounty hunters.

kiyell• 2 years ago

OP here, it's been interesting seeing people's view of this. I wanted to clarify two things.

The bug here is that unauthenticated users can change a setting that only an administrator should be able to. The maintainers acknowledged the bug and accepted a patch to fix it.

Is changing the temperature unit shown on a dashboard a serious problem? No. But it is a problem and one that could be classified as a security issue.

What's the point of the CVE assignment? Well it creates a public record of this flaw and helps Pi-hole administrators make their own decisions (patch / ignore). It also puts the issue in the hands of other security researchers. For example, is there a possibility of using this vulnerability to conduct a DoS attack? I didn't test this and have moved on to other things but others can.

The Harmless Pi-Hole Bug

Related Stories