Security Update Guide - Microsoft Security Response Center
msrc.microsoft.com
  • bruhduh@lemmy.worldEnglish
    36·
    1 month ago

    Yay, new Xbox jailbreak method, can’t wait for new modded warfare videos about it

      • Malfeasant@lemm.eeEnglish
        2·
        1 month ago

        I did that years ago, and they said basically “never”. Then a couple years later all of a sudden, there it was.

  • Blaster M@lemmy.worldEnglish
    275·
    1 month ago

    To note: It shows even Windows Server 2008 as affected. Since MS is only testing against OSses they support, it is possible this has existed as a problem all the way back since IPv6 was first introduced to Windows XP.

    Also, for all of you “disable IPv6 because I don’t understand it” people… unless you are running Windows 8 or older, just update Windows. IPv4 has been out of addresses for so long that CGNAT is a thing, which means connectivity problems when you’re hosting stuff, and more latency and packet drops from ISP routers getting saturated with NAT tasks. IPv6 is alive on the internet since 2011 and very much used on the internet, does not tie up routers by requiring NAT translation, and therefore just performs better. Plus, if you use your network printer’s or network device’s link-local ipv6 to connect locally, you will never have to deal with static ip address or changing ipv4 lan address pain, as link-local (non-routable on the internet) addresses don’t change unless you force it.

    Also don’t use $35 routers for your internet. If your router does not support ipv6 firewalling, it is long since time to fix that with one that does.

  • LaggyKar@programming.devEnglish
    191·
    1 month ago

    This would presumably mainly be an issue for computers open to the internet. So not so much for home PCs, unless the router’s firewall is opened up.

    • r00ty@kbin.life
      16·
      1 month ago

      I’ve not read the CVE but assuming it works on any IPv6 address including the privacy extensions addresses, it’s a problem. Depending on what most routers do in terms of IPv6 firewalling.

      My opinion is, IPv6 firewalls should, by default, offer similar levels of security to NAT. That is, no unsolicited incoming connections but allow outgoing ones freely.

      In my experience, it’s a bit hit-and-miss whether they do or not.

      Now, if this works on privacy extension addresses, it’s a problem because the IPv6 address could be harvested from outgoing connections and then attacked. If not, then scanning the IPv6 space is extremely hard and by default addresses are assigned randomly inside the /64 most people have assigned by their ISP means that the address space just within your own LAN is huge to scan.

      If it doesn’t work on privacy extension IPs, I would say the risk is very low, since the main IPv6 address is generally not exposed and would be very hard to find by chance.

      Here’s the big caveat, though. If these packets can be crafted as part of a response to an active outgoing TCP circuit/session. Then all bets are off. Because a popular web server could be hacked, adjusted to insert these packets on existing circuits/sessions in the normal response from the web server. Meaning, this could be exploited simply by visiting a website.

      • Toribor@corndog.socialEnglish
        9·
        1 month ago

        IPv6 firewalls should, by default, offer similar levels of security to NAT

        I think you’re probably right. We had decades of security experts saying that NAT is not a firewall and everyone on the planet treated it like one anyway. Now we’re overexposed for a no-NAT IPV6 internet.

      • LarmyOfLone@lemm.eeEnglish
        31·
        1 month ago

        What about torrenting through a VPN with IPv6? Would that make you vulnerable to this exploit?

        • r00ty@kbin.life
          3·
          1 month ago

          I think it depends on all the caveats I mentioned. If it could have worked with an outgoing connection, then someone with a bad client could execute it for sure. The VPN wouldn’t protect you.

      • LaggyKar@programming.devEnglish
        2·
        1 month ago

        Harvesting IP addresses shouldn’t be a problem, since the firewall shouldn’t allow packets from a peer you haven’t talked to first. But true, if you can be attacked in response by a server you’re connecting to that would be bad.

    • RvTV95XBeo@sh.itjust.worksEnglish
      3·
      1 month ago

      For a professional sysadmin’s home network? Maybe. For the average Joe who probably has their 12-year-old toaster still connected to their wifi? I wouldn’t bank on it.

  • GluWu@lemm.eeEnglish
    132·
    1 month ago

    I just updated and now my audio sounds like shit.

      • GluWu@lemm.eeEnglish
        4·
        1 month ago

        One restart post-update restarts changed it and helped, but something was still off. Took me like 30 minutes but it looks like my nvidia HDMI audio output got reset to a really low 16 bit sample rate. Got that set back to a decent 24 bit and its closer, but something is still off. I don’t think I had any settings/levels/enchanments.

        • ColeSloth@discuss.tchncs.deEnglish
          6·
          1 month ago

          Sounds like windows changed your audio driver. I’d download the most recent audio driver available through nvidia, then uninstall your current audio driver in device manager and manually install nvidias.

  • MehBlah@lemmy.worldEnglish
    101·
    1 month ago

    I tried to roll out ipv6 when I was sysadmin for a small ISP. ARIN gave me a /32 block with no fuss. I started handing them out only to discover most routers at the time couldn’t use them. Not much has changed. No one offers them and I just turned it off at my present job. None of my windows machine have the ipv6 stack enabled.

  • NaoPb@eviltoast.orgEnglish
    3·
    1 month ago

    I’m not running my computer with an IPv6 address. Only my modem has an IPv6 address. Does that mean I’m not affected?

    I’ll make sure to updats either way though.