Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #18111

Re: scylldb and php? anyone building a site with them on archlinux?

Show all headers | View raw

J.O. Aho:

> On 09/11/2019 23.58, Arno Welzel wrote:
[...]
>> Sure - but what vulnerability of systemd could be exploited remotely so
>> it is problem for webservers? I don't remember any.
> 
> Here is a example of remote code execution vulnerability that systemd 
> had a couple of years ago:
> 
> https://www.openwall.com/lists/oss-security/2017/06/27/8
> 
> Sure it's not a simple attack, but if you have managed to get hold of a 
> machine in the network, some arp poisoning and you are able to start 
> execute code on machines which not up to date.
> 
> 
> You also have this one from last year:
> 
> https://meterpreter.org/cve-2018-15688-systemd-remote-code-execution/
> 
> Also you would need taken control of a machine in the network.

Thanks for the references.

Indeed, this looks not good - but as you said: it's not a simple attack
as the first vulnerability can only be exploited by having a server to
communicate with a malicious nameserver of the attacker. Usually public
servers just don't to that and even desktop machines of end users often
just use the nameserver of the ISP or the router.

The second one is more critical but as I understand it also not relevant
for public servers.

> If you compare with any other init system, they never have had this kind 
> of security vulnerabilities, as they do not handle other  things than 
> initialize the system and those do not have the capability of sending 
> receiving data from an external source.

Sure.

> The only thing I can compare systemd when it comes to potential future 
> vulnerabilities is the worst of microsoft windows xp vulnerabilities, 
> where someone could become a super-administrator (there been this kind 
> of vulnerabilities in later versions of microsoft windows, but far less 
> and there are some built in measures to try to prevent these which 
> completely lacks in systemd).

Even Microsoft learned their lessons and I dont't see why systemd should
get worse than it is.


-- 
Arno Welzel
https://arnowelzel.de

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

scylldb and php?  anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-11-04 20:04 -0800
  Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-05 07:03 +0100
    Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-11-04 22:14 -0800
      Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-05 18:34 +0100
        Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-11-06 12:22 -0800
          Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-07 06:57 +0100
            Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-11-07 05:35 -0800
              Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-07 21:49 +0100
                Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-12-26 14:22 -0800
    Re: scylldb and php? anyone building a site with them on archlinux? Arno Welzel <usenet@arnowelzel.de> - 2019-11-08 01:54 +0100
      Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-08 06:46 +0100
        Re: scylldb and php? anyone building a site with them on archlinux? Arno Welzel <usenet@arnowelzel.de> - 2019-11-09 17:03 +0100
          Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-09 20:58 +0100
            Re: scylldb and php? anyone building a site with them on archlinux? Arno Welzel <usenet@arnowelzel.de> - 2019-11-09 23:58 +0100
              Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-10 10:26 +0100
                Re: scylldb and php? anyone building a site with them on archlinux? Arno Welzel <usenet@arnowelzel.de> - 2019-11-10 10:59 +0100
                Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-10 11:15 +0100
                Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-12-26 14:25 -0800
                Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-12-26 14:25 -0800
                Re: scylldb and php? anyone building a site with them on archlinux? Arno Welzel <usenet@arnowelzel.de> - 2019-12-30 15:28 +0100
      Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-12-26 14:23 -0800
  Re: scylldb and php? anyone building a site with them on archlinux? Härra Rabmo <he12091983@gmail.com> - 2022-07-08 06:45 -0700

csiph-web