Source
r/homelab•
Entropy

Time to upgrade glibc. Hope you don't have too many VMs. Or network equipment running linux. If your fridge runs linux, better check that too

I'm staring so hard at my ASUS router right now.

Good luck to all the sysadmins out there.

Posted Feb 17, 2016, 1:00 AM UTC

913
NerdnubI hide the electrical bill from my wife.•

Is your fridge running Linux? Well, you better go and patch it!

13
synk2•

I giggled. Well played.

1
EntropyOP•

I walked into that one

1
vanquish28HP ArcSight Support Engineer•

So what is the advisory for glibc?

Edit: Duh already on r/netsec

https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html

3
fmillion•

These incidents are always bittersweet--there's plenty of old Linux based hardware from the late 2000s that is deprecated and no longer patched/updated but is still in regular use, especially in the consumer space.

Whether the manufacturer will update, actively take the opportunity to push (pricey) upgrades, or just literally do nothing (it's unsupported so we don't care) is up to each manufacturer, but sadly, poor Grandma and Auntie Sue will probably be the first to get exploited...

And of course, security is always a hard sell to the uninformed--there's always the "ain't broke, so don't fix it" combined with "it'll never happen to me" attitudes--and when you add in the real cost, and in some cases even a learning curve for a new UI, people are even harder to convince.

2
EntropyOP•

I understand the bitter part, but where's the sweet?

3
fmillion•

If a device will never be patched, it'll always be hackable. iPhone 4's (not 4S) are basically permanently jailbreakable for this reason. As are many other outdated devices that will never see another update but have a known, exploitable bug (and are still in use). So as much as devices in active use should be patched, hackers (both white and black hat) will find some sweet in permanently exploitable devices...

3
rmg22893•

I'm looking at my EdgeRouter Lite right now wondering what to do. I was not prepared for this.

1
EntropyOP•

I got lucky. Merlin doesn't use glibc.

1
redditphantom•

This might help. It also appears to be fixed in 1.7.0alpha2 according to this article

1
TronLightyear•

wait for a firmware update, chances are you may not be impacted as i was under the impression these devices are running freebsd which may not be impacted by this.

0
BetterHomeWifi•

EdgeOS is based on vyatta, which is based on Debian.

The latest EdgeOS versions are based on wheezy.

3
TronLightyear•

Ahhh I thought vyatta was bsd but cool TIL

1