Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

is it wormable?


It's in the executive summary that it's not wormable on its own:

> An attacker must have the ability to execute code on a victim system to exploit this vulnerability.


I have a question if I may, what is the difference between a worm and not being a worm?


Worms will often take down a large network from exponential growth. Upside is a non-wormable bug won’t do that, but you need to prevent and look for exploitation.

This is tough as print is a dumpster fire in general, and who knows what’s lurking.


wormable generally means that from one infected computer you can infect another computer with no human interaction.

In general, not much is wormable across the internet anymore due to most devices being behind NAT. Within many companies, there are very few firewalls, so with a wormable exploit any attacker who is running malware on one computer would be able to infect most/all other computers.


No, but it’s pretty trivial to exploit in combination with other things.


What "other things" can it be combined with to get RCE?


Privilege escalation is what you do after you get unprivileged code execution, remote or otherwise, letting you then install an implant or something. If you want defense in depth, it's important to squash these issues, too, but they seem somewhat more common than RCEs.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: