Interesting how this has been widely reported as a Rust issue but the fact that other languages have no patches yet or do not even plan to patch it has seen little attention.
this post was submitted on 11 Apr 2024
24 points (100.0% liked)
Cybersecurity
5764 readers
58 users here now
c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
- Be respectful. Everyone should feel welcome here.
- No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
- No Ads / Spamming.
- No pornography.
Community Rules
- Idk, keep it semi-professional?
- Nothing illegal. We're all ethical here.
- Rules will be added/redefined as necessary.
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
Notable mention to [email protected]
founded 2 years ago
MODERATORS
Seems like a Windows issue, not a Rust one. Odd choice to assign it to Rust.
Yeah, seems very much like "Rust fails to implement elaborate enough workaround for a stupid design choice in Windows".
I think it's because it was first identified in Rust so news media ran with that.
I think it's partly because Rust has been promoted as inherently secure.
But nothing is so secure that it automatically fixes all design flaws in everything it interacts with.
Absolutely. I merely suggested a contributing factor to answer why media coverage seems so focused on Rust.
This is the best summary I could come up with:
Programmers are being urged to update their Rust versions after the security experts working on the language addressed a critical vulnerability that could lead to malicious command injections on Windows machines.
It affects the Rust standard library, which was found to be improperly escaping arguments when invoking batch files on Windows using the Command API.
"An attacker able to control the arguments passed to the spawned process could execute arbitrary shell commands by bypassing the escaping," said Pietro Albini of the Rust Security Response Working Group, who wrote the advisory.
The language is a fan favorite, routinely topping Stack Overflow's rankings for how enjoyable developers find Rust to use in their work, and Googlers hail its productivity benefits.
According to RyotaK, the researcher who reported the vulnerability, which they are referring to as BatBadBut due to it revolving around batch files and its severity – "bad, but not the worst" – the issue affects more technologies than Rust alone.
RyotaK also made the point that users should not jump to conclusions based on the CVSS rating alone, since the severity of the issue will depend on each application individually and should be recalculated as such.
The original article contains 552 words, the summary contains 195 words. Saved 65%. I'm a bot and I'm open source!
Good bot