Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #18110

Re: scylldb and php? anyone building a site with them on archlinux?

Show all headers | View raw

On 09/11/2019 23.58, Arno Welzel wrote:
> J.O. Aho:
> 
>> On 09/11/2019 17.03, Arno Welzel wrote:
>>
>>> If a vulnerability allows code execution it does not matter, if PHP is
>>> used as an init system or not. The attacker does not need to gain full
>>> access over a system to compromise a website and abuse it for his own
>>> purposes.
>>
>> Sure, a code execution vulnerability is a serious problem no matter
>> which application has the vulnerability, but when it's process number 1
>> which has this vulnerability the problem is a lot worse than a process
>> that is run as a none privileged user. A none privileged user can do
>> less damage to the system than the one root user which has power over
>> them all (even worse than run a vulnerable php as root user).
> 
> Sure - but what vulnerability of systemd could be exploited remotely so
> it is problem for webservers? I don't remember any.

Here is a example of remote code execution vulnerability that systemd 
had a couple of years ago:

https://www.openwall.com/lists/oss-security/2017/06/27/8

Sure it's not a simple attack, but if you have managed to get hold of a 
machine in the network, some arp poisoning and you are able to start 
execute code on machines which not up to date.


You also have this one from last year:

https://meterpreter.org/cve-2018-15688-systemd-remote-code-execution/

Also you would need taken control of a machine in the network.


If you compare with any other init system, they never have had this kind 
of security vulnerabilities, as they do not handle other  things than 
initialize the system and those do not have the capability of sending 
receiving data from an external source.

The only thing I can compare systemd when it comes to potential future 
vulnerabilities is the worst of microsoft windows xp vulnerabilities, 
where someone could become a super-administrator (there been this kind 
of vulnerabilities in later versions of microsoft windows, but far less 
and there are some built in measures to try to prevent these which 
completely lacks in systemd).


-- 

  //Aho

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

scylldb and php?  anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-11-04 20:04 -0800
  Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-05 07:03 +0100
    Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-11-04 22:14 -0800
      Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-05 18:34 +0100
        Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-11-06 12:22 -0800
          Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-07 06:57 +0100
            Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-11-07 05:35 -0800
              Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-07 21:49 +0100
                Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-12-26 14:22 -0800
    Re: scylldb and php? anyone building a site with them on archlinux? Arno Welzel <usenet@arnowelzel.de> - 2019-11-08 01:54 +0100
      Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-08 06:46 +0100
        Re: scylldb and php? anyone building a site with them on archlinux? Arno Welzel <usenet@arnowelzel.de> - 2019-11-09 17:03 +0100
          Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-09 20:58 +0100
            Re: scylldb and php? anyone building a site with them on archlinux? Arno Welzel <usenet@arnowelzel.de> - 2019-11-09 23:58 +0100
              Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-10 10:26 +0100
                Re: scylldb and php? anyone building a site with them on archlinux? Arno Welzel <usenet@arnowelzel.de> - 2019-11-10 10:59 +0100
                Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-10 11:15 +0100
                Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-12-26 14:25 -0800
                Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-12-26 14:25 -0800
                Re: scylldb and php? anyone building a site with them on archlinux? Arno Welzel <usenet@arnowelzel.de> - 2019-12-30 15:28 +0100
      Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-12-26 14:23 -0800
  Re: scylldb and php? anyone building a site with them on archlinux? Härra Rabmo <he12091983@gmail.com> - 2022-07-08 06:45 -0700

csiph-web