Onno (VK6FLAB)

Anything and everything Amateur Radio and beyond. Heavily into Open Source and SDR, working on a multi band monitor and transmitter.

#geek #nerd #hamradio VK6FLAB #podcaster #australia #ITProfessional #voiceover #opentowork

  • 24 Posts
  • 751 Comments
Joined 2 years ago
cake
Cake day: March 4th, 2024

help-circle







  • How would you suggest I respond in the future?

    We have a person, claiming that CUPS doesn’t work and they now uninstall it on every installation.

    There is no context, no data, no information that suggests what the issue is, what they tried, when this occurred, on which platform, under which conditions.

    In other words, the user was essentially saying “CUPS sux”.

    Having used Linux as my main system for over 25 years, that sentiment did not match my own experience, does not help anyone, not me, not the user and not the OP who was trying to solve a problem, let alone anyone else reading along.

    I responded accordingly.









  • It essentially depends on what level of support you require.

    End Of Life is a concept, not generally a fixed point in time … even though the likes of Microsoft are attempting to rewrite history and making everyone move off Windows 10 by a specific date.

    And just like in that situation, you have options.

    You can consider your relationship with Microsoft at an end and install a different OS, or you can continue the relationship and buy new hardware even though there’s absolutely nothing wrong with what you currently have.

    The same is true for a router.

    The decision around EOL is about what happens next.

    Do you want to yell at the supplier if it breaks, or will you realise that yelling only happens if you spend money on lawyers, and in the meantime you can move on with your life and decide on an alternative path.

    My car is worth $700 or so, even though I bought it new 15 years ago. Is it at the end of its life? It’s still getting me from here to there and back.


  • From a security perspective I’d be surprised if number of mentions as a metric has any bearing whatsoever on the impact or urgency of a CVE.

    If you’re using mentions as a proxy for affected user base, I’d hazard an opinion that there are better ways of determining the impact footprint of a CVE.

    Finally, a vulnerability rating or priority is determined and published with each CVE, so I’d expect that this would take into account some of those considerations.

    That said, a vendor ranking seems like something that I’ve not seen before, mind you, the notion that Microsoft didn’t make it into the list is gobsmacking considering that patch Tuesday addressed 81 flaws and 2 zero-days in September.

    In my opinion, he idea seems useful, but the execution needs some work.




  • The Australian government has just emailed the following:

    ASD’s ACSC is aware of targeting of multiple vulnerabilities within Australia impacting Cisco ASA 5500-X Series models, that are running Cisco ASA Software or FTD software:

    CVE-2025-20333 (Critical) – A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device.

    CVE-2025-20363 (Critical) – A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device.

    CVE-2025-20362 (Medium) – A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that should otherwise be inaccessible without authentication.

    A number of versions of Cisco software releases are affected, including those within the following ranges:

    Cisco ASA Software releases 9.12 to 9.23x and; Cisco FTD Software releases 7.0 to 7.7x.

    Please see

    https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks for specific version details.

    Cisco reports active exploitation of these vulnerabilities has been observed globally.