2025-09-08 11:19 UTC
Replies (14)
-
@micahflee@infosec.exchange 2025-09-08 16:01
Update: He has updated Apache to 2.4.65! Public disclosure after getting privately ignore works, it turns out
-
@hko@floss.social 2025-09-08 11:22
"(Which, honestly, isn't very fair, since I'm not ICE.)" lol
-
@h0ng10@infosec.exchange 2025-09-08 11:50
@micahflee Please note that installing the latest Ubuntu security updates for Apache httpd does not necessarily upgrade Apache to the latest available version. Instead, security fixes are typically backported to the version included with the distribution. As a result, the displayed version remains unchanged. For example, even after fully updating Ubuntu 22.04 LTS, the Apache version shown in the Server header still appears as 2.4.52, despite being patched with the latest security fixes.
-
@patpro@social.patpro.net 2025-09-08 11:55
@micahflee there’s a lot to say, actually: https://www.shodan.io/host/69.164.211.16
-
@sysop@runbsd.duckdns.org 2025-09-08 12:24
@micahflee you did the right thing.
-
@dalias@hachyderm.io 2025-09-08 12:30
@micahflee Can you clarify whether you have any reason to believe it's actually vulnerable to anything? Most of those vulns only affect wacky configurations, commercial hosting environments where the customers are untrusted and may be running malicious serverside code, and particular types of web application stuff (vs static content). Personally I tend to look unkindly on vuln reporters who assert that something of mine is vulnerable based on some checklist for the version they find running rather than actual analysis.
-
@faraiwe@mstdn.social 2025-09-08 13:39
@micahflee GASP. You mean the closet corporate shill is a scammer whose sole aim is to collect data, to sell it later, as every other such scammer whose software runs in a corporate walled garden environment does?!?!? Quelle fucking surprise. #ICEBlock #apple #privacy #ICE #MAGAt #gestapo #USPol
-
@GroupNebula563@mastodon.social 2025-09-08 14:16
@micahflee ironically, these are the same people saying android isn't secure
-
@lfzz@mastodon.social 2025-09-08 16:03
@micahflee how hard is it to have a cronjob that auto update/upgrade everything.
-
@d_olex@mastodon.social 2025-09-08 18:05
@micahflee “And, as I showed you before, just one of the vulns is CVE-2024-38476, which you can read about here” — LMAO, I’m 100% sure that even you haven’t read it. It’s unrelated vuln with very complex and unrealistic exploitation scenario
-
@mfarrar@kolektiva.social 2025-09-08 19:39
@micahflee I love every time I find a comment section that validates my “all techies are insufferable cunts” bias. Leave it to men, I guess, to take being an asshole as a core part of their identity. 🙄
-
@SpaceLifeForm@infosec.exchange 2025-09-08 22:26
@micahflee Yet another reason to avoid besides the traffic analysis.
-
@dancingtreefrog@mastodon.social 2025-09-08 22:38
@micahflee Hmmm, so he's actually working for ICE?
-
@Li@tech.lgbt 2025-09-09 04:14
@micahflee the CVE in question is unlikely to effect ICEBreaker https://httpd.apache.org/security/vulnerabilities_24.html "Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable." basically, the server would have to behind a reverse proxy, and you'd have to have control over the server that is running behind said reverse proxy, and you could use that to take control of the server running the proxy.. so if you were able to have prerequisite conditions to actually do this, ICEBlock would already be compromised i would agree the response def shouldn't be blocking you outright and updating prolly won't hurt or anything, and ICEBlock in general screams honeypot, and thus is generally unexploitable. and not actually an immediate issue,