Cybersecurity

5764 readers

44 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Be respectful. Everyone should feel welcome here.
No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
No Ads / Spamming.
No pornography.

Community Rules

Idk, keep it semi-professional?
Nothing illegal. We're all ethical here.
Rules will be added/redefined as necessary.

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]

Notable mention to [email protected]

founded 2 years ago

MODERATORS

kid

[email protected]

Rust addresses critical vulnerability on Windows (www.theregister.com)

submitted 7 months ago by kid to c/cybersecurity

9 comments fedilink hide all child comments

The vulnerability, which carries a perfect 10 base severity score, is tracked as CVE-2024-24576. It affects the Rust standard library, which was found to be improperly escaping arguments when invoking batch files on Windows using the Command API.

you are viewing a single comment's thread
view the rest of the comments

[–] taladar 24 points 7 months ago (3 children)

Interesting how this has been widely reported as a Rust issue but the fact that other languages have no patches yet or do not even plan to patch it has seen little attention.

[–] CancerMancer 15 points 7 months ago (1 children)

Seems like a Windows issue, not a Rust one. Odd choice to assign it to Rust.

[–] taladar 11 points 7 months ago

Yeah, seems very much like "Rust fails to implement elaborate enough workaround for a stupid design choice in Windows".

[–] [email protected] 7 points 7 months ago

I think it's because it was first identified in Rust so news media ran with that.

[–] [email protected] 4 points 7 months ago (1 children)

I think it's partly because Rust has been promoted as inherently secure.

[–] taladar 9 points 7 months ago (1 children)

But nothing is so secure that it automatically fixes all design flaws in everything it interacts with.

[–] [email protected] 4 points 7 months ago

Absolutely. I merely suggested a contributing factor to answer why media coverage seems so focused on Rust.