Rendered at 04:26:22 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
tptacek 3 hours ago [-]
This is such a venerable and ancient class of bugs, going at least as far back as AIX 3. Glad to see they're still makin' 'em like they used to.
(If you had SSH access to a host in your Tailscale ACL, you could log in as `-i` and get a root login.)
RossBencina 1 hours ago [-]
I'm somewhat alarmed that the context that this bug was running in was capable of root login. Is there a reason that an SSH login process would, by default, have enough capabilities to facilitate direct root login?
yjftsjthsd-h 50 minutes ago [-]
If it runs as your user and can only log in as you, then I wouldn't expect it to be able to become root. But if it can log you in as different users, I would expect that 1. it needs to run from root, and 2. it can log in as root.
iririririr 2 hours ago [-]
you can also add parameters to env vars in some popular cloud providers for the same effect.
doublepg23 2 hours ago [-]
I’m a heavy Tailscale user, so I do trust them quite a bit, but I never used the Tailscale SSH feature.
I feel like OpenSSH’s security record is pretty unbeatable, not sure why I’d swap over for such a security-sensitive tool.
jdiff 2 hours ago [-]
I've used it before to access my tailnet machines through a browser on a machine I can't download software on.
dgacmu 2 hours ago [-]
I used it for a bunch of remote monitor boxes to have a way of centrally managing ssh access to things that were often on- and off-line. It was simple and convenient and access was easily revocable.
bakies 2 hours ago [-]
Yeah pretty much just use tailscale as a vpn.. do one thing as they say.
isatty 2 hours ago [-]
Convenience for the most part but in general, I agree. I like having it as an option.
drnick1 1 hours ago [-]
I'll stick to my 100% self-hosted Wireguard setup, thank you very much.
m_mueller 14 minutes ago [-]
Why not tailscale plus head scale for self hosting?
mintflow 36 minutes ago [-]
>>> We would like to thank Anthropic and Ada Logics for reporting this issue.
it seems anthropic also use tailscale or it's just being discovered by the mythos model?
e40 3 hours ago [-]
So, giving access via tailscale but using OpenSSH is safe, right?
lugoues 3 hours ago [-]
Yes, this only involves their wrapper that is managed by ACL rules.
iririririr 2 hours ago [-]
as much as handing control to a remote third part is, yes.
cevn 36 minutes ago [-]
Good point. I self host headscale but it also has the ssh feature, probably also insecure.
mintflow 34 minutes ago [-]
pure logic error, the undergoing tailscale rust rewrite can't help this too:)
mintflow 33 minutes ago [-]
that said, the limit impact perhaps is only affected multiple users in tailnet if the ACL is not configure correctly
As single tailnet+single user, perhaps it's just okay
luciana1u 1 hours ago [-]
tailscale ssh: replacing a 25-year-old battle-tested codebase with a startup's Go rewrite and then acting surprised when it has bugs
47 minutes ago [-]
modeless 2 hours ago [-]
Tailscale SSH has caused me other problems in the past because it takes over port 22. I'm not a fan.
LeoPanthera 2 hours ago [-]
That is what it's supposed to do, though. It's not a secret.
huflungdung 2 hours ago [-]
[dead]
kbumsik 3 hours ago [-]
Why own numbering instead of CVE?
vngzs 3 hours ago [-]
It lets organizations (Tailscale) control the timing and narrative around the disclosure more directly. Organizations sometimes avoid the bureaucracy of going through CVE Numbering Authorities by self-publishing. Often a CVE assignment follows self-disclosure, especially when there's pressure to interoperate with vuln-scanning/compliance tooling
bigfatkitten 2 hours ago [-]
And sometimes it’s just impossible to get a CVE number in a reasonable amount of time, or indeed at all.
cyberax 3 hours ago [-]
> "Tailscale SSH now rejects usernames with leading dashes."
Really? That's the fix?
A proper fix is to use "--" to separate arguments.
valleyer 2 hours ago [-]
A proper fix is not to shell out to a command at all; use getpwnam(3) or similar.
sedatk 3 hours ago [-]
Their fix just future-proofs it in case the same bug gets reintroduced.
turbert 1 hours ago [-]
A correct implementation would be to just call glibc directly, this seems like a hasty fix to get the patch out the door. The history of vulns from bad shell escaping is as old as bash, whenever possible you probably shouldn't be mixing code and data, especially in a security critical application like this.
cyberax 2 hours ago [-]
This is just a dirty fix. It adds weird restrictions and masks issues.
Refactoring external invocations to use safe argument handling is a better way to fix it. Along with tests that exercise weird names.
I argue the opposite: there’s no better fix for this. You can write the most elegant fix, whatever it is, and prevent that from happening only on the codebase that’s fixed. That doesn’t mean that the codebase will always be the only authority on authentication.
The username policy fixes this issue for good, regardless of whatever you write in the future, or whatever new mechanism is introduced.
It’s a restriction for sure, but it’s not a nonsense restriction? Who would have a username starting with a hyphen? I didn’t even know it was possible until today.
turbert 1 hours ago [-]
> I argue the opposite: there’s no better fix for this
The better fix would be to not have the username pass through a parser looking for cli flags in the first place.
(If you had SSH access to a host in your Tailscale ACL, you could log in as `-i` and get a root login.)
it seems anthropic also use tailscale or it's just being discovered by the mythos model?
As single tailnet+single user, perhaps it's just okay
Really? That's the fix?
A proper fix is to use "--" to separate arguments.
Refactoring external invocations to use safe argument handling is a better way to fix it. Along with tests that exercise weird names.
The username policy fixes this issue for good, regardless of whatever you write in the future, or whatever new mechanism is introduced.
It’s a restriction for sure, but it’s not a nonsense restriction? Who would have a username starting with a hyphen? I didn’t even know it was possible until today.
The better fix would be to not have the username pass through a parser looking for cli flags in the first place.