Share story
Security Infrastructure

Tailscale fixes SSH forwarding flaws exposing root-only services

Tailscale fixes SSH forwarding flaws exposing root-only services Image: Primary
Tailscale has released version 1.104.4 to fix SSH forwarding flaws that could let an attacker controlling an authorized device reach root-only services on another server, The Hacker News reported. Exploitation requires an SSH connection permitted by network policy, with forwarding allowed. The fix makes the server forward connections as the logged-in user rather than root and rely on operating-system file permissions. Researcher Erica Windisch obtained a root shell through the Docker control socket in laboratory tests; Tailscale describes the exposure as access to privileged sockets. Administrators unable to update can disable SSH forwarding through the service environment. Tailscale's check mode, which requires a fresh sign-in, does not block flaws exploited within an approved session.
Sources
The Hacker News
Published by Tech & Business, a media brand covering technology and business. This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.
Back to Newswire
Keep reading
Full wire
AI Security
AI Security

Anthropic says internal AI model built working exploit chains

Anthropic says an unreleased internal AI model found security flaws and combined them into working proof-of-concept exploits across browsers and operating systems. The company described five chains built in laboratory tests after ...

The Hacker News
Products
Products

Harvest says Hong Kong regulator authorized STAR chip ETF

Harvest Global Investments said Hong Kong's Securities and Futures Commission authorized its Harvest STAR Chip ETF on October 28. The fund will list on the Hong Kong stock exchange, offering investors indirect exposure to mainland...

Yahoo Finance
Security Products
Security Products

GMO opens $1 million bounty after trading desktop cloud breach

GMO Internet Group opened a reward program on October 28 offering up to $1 million in total for information that helps lead to an arrest or international wanted notice over its Onamae.com Desktop Cloud breach. The service hosts Wi...

The Hacker News
Products Infrastructure
Products Infrastructure

Jio rises 21% on market debut after $3.2 billion IPO

Jio Platforms rose 21% in its Wednesday stock market debut after raising $3.2 billion in India's largest IPO, TechCrunch reported. The Indian telecom and digital services company attracted more than $77 billion in bids; the offeri...

TechCrunch
Security
Security

Coinbase says Amplitude incident exposed some customer contact data

Coinbase said a security incident at analytics provider Amplitude affected a small subset of its customers' contact data. The exchange said it found no evidence of unauthorized access to Coinbase systems and that customer funds we...

Digit