0.0.0.0 Day Vulnerability Discovered - Apparently been an issue since 2006

  • 🔧 At about Midnight EST I am going to completely fuck up the site trying to fix something.
Whiskeybone said:
Do I really need to update winblows or whatever over this?
There's a notice on the top of the site that doesn't link to any discussion and there's barely any in this thread
Click to expand...
I think the one at the top is a different one (because it dropped Tues and that dropped Mon) but I agree, we need a thread to discuss this bullshit.
 
  • Agree
  • Like
Reactions: 419, Prokhor Zakharov, Dynamite Bean and 1 other person
Whiskeybone said:
Do I really need to update winblows or whatever over this?
There's a notice on the top of the site that doesn't link to any discussion and there's barely any in this thread
Click to expand...
This is a completely separate issue that should warrant its own thread. And yeah, you should update now unless you know you're unreachable via IPv6, in which case you can defer it until tomorrow.
 
  • Informative
  • Like
Reactions: Prokhor Zakharov and Niggs Monaghan
Whiskeybone said:
Do I really need to update winblows or whatever over this?
There's a notice on the top of the site that doesn't link to any discussion and there's barely any in this thread
Click to expand...
Yes. Update your software if you dont want it to be full of security vulnerabilities retard
 
  • Like
Reactions: Prokhor Zakharov
Still trying to figure out what exactly is up with this, but it doesn't seem to be just a browser issue but sheer retardation from whatever spec specifies this behavior:
Code: 
$ ping 0
PING 0 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.020 ms
$ ping ::
PING :: (::) 56 data bytes
64 bytes from ::1: icmp_seq=1 ttl=64 time=0.026 ms
Why does this work? Why on earth would I ever want 0.0.0.0 or whatever to translate to localhost, let alone some other address?
In fact, from what I find (and understand) so far 0.0.0.0 is in fact not a valid destination address, so go figure.

Although yes, letting browsers fetch any resource willy nilly is retarded and has been a source of security issues since forever, not to mention making every application a webpage when a plain program/script would be fine. Modern internet browsers have a much too broad scope.
I still use uMatrix to disable JS by default, which should keep me a little more safe at least even if a more clever attacker could simply insert <img> tags.
 
  • Winner
Reactions: 419 and Kiwi & Cow
Gigantic Penguin said:
Why does this work?
Click to expand...
Some IPv4 addresses are special. Here's a list. Rather, here's the list:
We can see the sixteen million and some addresses in the zeroeth allocation refer to this network, and the address which is all zeroes refers to this host on this network. When I write a program that reserves a UDP port, this address is used for obvious reasons. The address which is all ones is a broadcast address.

There's no excuse to be unaware of this list, especially for people who are so adamant that their heads are not firmly lodged up their asses, like those idiots at Google.
 
Gigantic Penguin said:
Yes, but note that the same table indicates it is not valid as a destination address.
(likewise, 255.255.255.255/32 is not valid as a source address).
Click to expand...
Well, yes, but but that just means it gets treated specially by the IP implementation or something else, which appears to be the entire flaw from what I see.
 
The Backwards Man said:
Intel CPUs are fucked, AMD CPUs give your computer malware, Browsers are giving you malware too, Winblows giving the eternal BSOD, 2024 is truly the year we all redeemed when the Pajeet told us not to.
Click to expand...
Start hoarding pre-IME and PSP systems. They may be valuable someday.
 
You must log in or register to reply here.
Back