Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.privacy.anon-server > #66740

Re: Anyone know what this nginx error is about?

Cross-posted to 3 groups.

Show all headers | View raw

On 11/4/18 1:42 PM, Dan Espen wrote:
> "J.O. Aho" <user@example.net> writes:
> 
>> On 11/3/18 7:34 PM, James Moe wrote:
>>> On 11/2/18 12:50 AM, J.O. Aho wrote:
>>>
>>>> The reason to avoid systemd is that it's a big security vulnerability
>>>> risk and it eats up GNU applications.
>>>>
>>>   Wild accusations without a hint of proof.
>>
>> The larger code base, the higher risk for vulnerabilities and systemd
>> has been having security vulnerabilities quite often compared with the
>> other init systems
>>
>> https://blog.trendmicro.com/trendlabs-security-intelligence/systemd-vulnerability-leads-to-denial-of-service-on-linux/
> 
> DNS resovler.

Part of nss-systemd


>> https://www.infosecurity-magazine.com/news/linux-systemd-vulnerability-dns
> 
> DNS.

Part of nss-systemd


>> https://nvd.nist.gov/vuln/detail/CVE-2018-15686
> 
> Awaiting analysis, "possibly leading to".

Pottering has a tradition to not analyse vulnerabilities and want to fix
things in quiet, but someone from the systemd team seems to have
reported this security vulnerability.

>> https://nvd.nist.gov/vuln/detail/CVE-2018-15687
> 
> This vulnerability is currently awaiting analysis.  I can't tell what's
> at fault.
> 
>> https://nvd.nist.gov/vuln/detail/CVE-2018-15688
> 
> dhcp client.

which is part of libsystemd.

>> https://www.theregister.co.uk/2017/07/05/linux_systemd_grants_root_to_invalid_user_accounts/
> 
> To  exploit   the  issue,  an   attacker  would  have  to   convince  an
> administrator – someone who already has  root access – to install a unit
> file with an invalid user name.

No, it can be a misconfiguration (written the wrong username), user that
has been removed, user never been created. Nowadays much of large
computer parks are handled by tools like salt, chef, puppet to push out
changes and it happens sometimes you may miss to run a job on a machine
say creating a user and another day someone else just pushed out the
custom systemd unit and there you got an attack vector.


>> That just a handful during the last two years, which most people should
>> be able to find with a simple search engine query.
> 
> I fail to see how issues entirely within daemons are "systemd problems".

It's not daemons, it's the systemd container to run the daemon in and
parts of these do run in the PID1 which compromises your whole system if
there is a vulnerability...

-- 

 //Aho

Back to alt.privacy.anon-server | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Anyone know what this nginx error is about? Nomen Nescio <noreply@mixnym.net> - 2018-11-01 08:48 -0500
  Re: Anyone know what this nginx error is about? Nomen Nescio <noreply@mixnym.net> - 2018-11-01 20:21 -0500
    Re: Anyone know what this nginx error is about? Roger Blake <rogblake@iname.invalid> - 2018-11-02 02:14 +0000
      Re: Anyone know what this nginx error is about? Nomen Nescio <nobody@dizum.com> - 2018-11-08 09:49 +0100
    Re: Anyone know what this nginx error is about? "J.O. Aho" <user@example.net> - 2018-11-02 08:50 +0100
      Re: Anyone know what this nginx error is about? James Moe <jimoeDESPAM@sohnen-moe.com> - 2018-11-03 11:34 -0700
        Re: Anyone know what this nginx error is about? "J.O. Aho" <user@example.net> - 2018-11-04 09:36 +0100
          Re: Anyone know what this nginx error is about? Dan Espen <dan1espen@gmail.com> - 2018-11-04 07:42 -0500
            Re: Anyone know what this nginx error is about? "J.O. Aho" <user@example.net> - 2018-11-04 14:51 +0100
              Re: Anyone know what this nginx error is about? Dan Espen <dan1espen@gmail.com> - 2018-11-04 11:04 -0500
              Re: Anyone know what this nginx error is about? The Natural Philosopher <tnp@invalid.invalid> - 2018-11-04 18:12 +0000
    Re: Anyone know what this nginx error is about? The Natural Philosopher <tnp@invalid.invalid> - 2018-11-02 10:44 +0000
      Re: Anyone know what this nginx error is about? Bobbie Sellers <bliss@mouse-potato.com> - 2018-11-02 06:22 -0700
      Re: Anyone know what this nginx error is about? Nomen Nescio <noreply@mixnym.net> - 2018-11-02 09:06 -0500
        Re: Anyone know what this nginx error is about? The Natural Philosopher <tnp@invalid.invalid> - 2018-11-02 19:41 +0000
          Re: Anyone know what this nginx error is about? Nomen Nescio <noreply@mixnym.net> - 2018-11-02 15:36 -0500
            Re: Anyone know what this nginx error is about? The Natural Philosopher <tnp@invalid.invalid> - 2018-11-02 21:17 +0000
              Re: Anyone know what this nginx error is about? Nomen Nescio <noreply@mixnym.net> - 2018-11-02 20:36 -0500
                Re: Anyone know what this nginx error is about? The Natural Philosopher <tnp@invalid.invalid> - 2018-11-03 09:05 +0000
      Re: Anyone know what this nginx error is about? Andreas Kohlbach <ank@spamfence.net> - 2018-11-02 16:27 -0400
    Re: Anyone know what this nginx error is about? Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2018-11-02 13:05 +0200
      Re: Anyone know what this nginx error is about? Nomen Nescio <noreply@mixnym.net> - 2018-11-02 08:58 -0500
    Re: Anyone know what this nginx error is about? William Unruh <unruh@invalid.ca> - 2018-11-02 12:59 +0000
      Re: Anyone know what this nginx error is about? Dan Espen <dan1espen@gmail.com> - 2018-11-02 09:21 -0400
      Re: Anyone know what this nginx error is about? Nomen Nescio <noreply@mixnym.net> - 2018-11-02 09:01 -0500
        Re: Anyone know what this nginx error is about? Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2018-11-02 21:35 +0200
      Re: Anyone know what this nginx error is about? Andreas Kohlbach <ank@spamfence.net> - 2018-11-02 16:35 -0400

csiph-web