Yeah no, the same was said about the previous vulnerability in the SSH server. News stories just assume when people run an unpatched version they are vulnerable from attacks from the internet and run with those numbers. It makes for a better story, but it isn’t the whole truth. OOTB these kinds of things aren’t exposed to the outside world and exposing them isn’t trivial.
People should still patch and these vulnerabilities aren’t a good thing obviously, but the news stories have been pretty sensational for something that probably won’t impact a lot of users.
Wasn’t going off the article: I saw the SSH stuff last month and had double-checked I had all remote-access off on my config.
Then when I saw the latest story this morning, I ran an nmap that showed webfig was still exposed on my pub IP. Probably just due to some automatic bridging behavior that bit me, but I’ll have to confirm later.
I know, the articles just annoy me. I use a lot of Mikrotik stuff and it’s great. Then you get these MILLIONS OF USERS VULNERABLE!!! bullshit stories and it pisses me off.
Yeah no, the same was said about the previous vulnerability in the SSH server. News stories just assume when people run an unpatched version they are vulnerable from attacks from the internet and run with those numbers. It makes for a better story, but it isn’t the whole truth. OOTB these kinds of things aren’t exposed to the outside world and exposing them isn’t trivial.
People should still patch and these vulnerabilities aren’t a good thing obviously, but the news stories have been pretty sensational for something that probably won’t impact a lot of users.
Wasn’t going off the article: I saw the SSH stuff last month and had double-checked I had all remote-access off on my config.
Then when I saw the latest story this morning, I ran an nmap that showed webfig was still exposed on my pub IP. Probably just due to some automatic bridging behavior that bit me, but I’ll have to confirm later.
I know, the articles just annoy me. I use a lot of Mikrotik stuff and it’s great. Then you get these MILLIONS OF USERS VULNERABLE!!! bullshit stories and it pisses me off.