Vulnerability Disclosure
Posted by user1001
|
Vulnerability Disclosure May 24, 2018 09:54AM |
Registered: 5 years ago Posts: 3 |
Dear Marlin Community,
As the issue tracking of the Marlin Firmware are public github issues, I did not want to disclose a vulnerability of the firmware directly there.
Can someone please point me to a maintainer or responsible person with whom I could discuss further steps about the disclosure?
Thank you in advance.
Best
Felix
As the issue tracking of the Marlin Firmware are public github issues, I did not want to disclose a vulnerability of the firmware directly there.
Can someone please point me to a maintainer or responsible person with whom I could discuss further steps about the disclosure?
Thank you in advance.
Best
Felix
|
Re: Vulnerability Disclosure May 24, 2018 10:35AM |
Admin Registered: 13 years ago Posts: 6,998 |
|
Re: Vulnerability Disclosure May 24, 2018 10:43AM |
Registered: 5 years ago Posts: 3 |
Of course it is not network enabled. But It will parse and handle GCode, which can be malicious.
With control over the firmware, a lot of nasty things can be done:
e.g. [pdfs.semanticscholar.org]
With control over the firmware, a lot of nasty things can be done:
e.g. [pdfs.semanticscholar.org]
|
Re: Vulnerability Disclosure May 24, 2018 04:42PM |
Registered: 8 years ago Posts: 552 |
Marlin is Open Source. The whole community works together to improve Marlin.
Please post your concerns in this thread, and the community will work together to assess and mitigate the 'threat'.
Or better yet... Please create an issue at [github.com] If the issue is real, it will get fixed ASAP.
Security Through Obscurity Is Not an Answer: [www.pearsonitcertification.com]
Edited 3 time(s). Last edit at 05/24/2018 04:49PM by Roxy.
Please post your concerns in this thread, and the community will work together to assess and mitigate the 'threat'.
Or better yet... Please create an issue at [github.com] If the issue is real, it will get fixed ASAP.
Security Through Obscurity Is Not an Answer: [www.pearsonitcertification.com]
Edited 3 time(s). Last edit at 05/24/2018 04:49PM by Roxy.
|
Re: Vulnerability Disclosure May 24, 2018 05:28PM |
Registered: 8 years ago Posts: 552 |
The good news is... If you are worried about what firmware is in your printer... You can keep a version of it that you trust on your SECURE computer, and reflash it before each and every print.
But my guess is, most hobbiest's aren't worried about somebody altering the firmware on their printer.
But my guess is, most hobbiest's aren't worried about somebody altering the firmware on their printer.
|
Re: Vulnerability Disclosure May 24, 2018 08:27PM |
Registered: 6 years ago Posts: 1,863 |
|
Re: Vulnerability Disclosure May 25, 2018 03:13AM |
Registered: 5 years ago Posts: 3 |
That is exactly what we did and we found a vulnerability where Gcode is not handled correctly. The exploit allows more capabilities than what can be achieved with Gcode commands.
My question is: How to fix this? Just a pull request agains the github repo?
It might be useful to coordinate it with a release, that affected, worried users could install the patch in a timely manner.
My question is: How to fix this? Just a pull request agains the github repo?
It might be useful to coordinate it with a release, that affected, worried users could install the patch in a timely manner.
|
Re: Vulnerability Disclosure May 26, 2018 11:57AM |
Registered: 8 years ago Posts: 552 |
|
Re: Vulnerability Disclosure May 26, 2018 12:00PM |
Registered: 8 years ago Posts: 552 |
Quote
Roberts_Clif
Not worried about anyone hacking Marlin source code, Their are many programmers watching the new versions of Marlins source code very closely.
And in fact... typically people do not share GCode files. They share .STL files and each person slices that file for their printer.
About the only time we share GCode files is when we have some problem and it requires a lot of state information to be setup correctly to see it. And in those cases, we try to edit out as much of the file as we can prior to sharing it.
|
Re: Vulnerability Disclosure May 26, 2018 12:13PM |
Registered: 6 years ago Posts: 1,863 |
Quote
Roxy
And in fact... typically people do not share GCode files. They share .STL files and each person slices that file for their printer.
About the only time we share GCode files is when we have some problem and it requires a lot of state information to be setup correctly to see it. And in those cases, we try to edit out as much of the file as we can prior to sharing it.
Exactly! Correct.
Sorry, only registered users may post in this forum.