Re: scylldb and php? anyone building a site with them on archlinux?

From	"J.O. Aho" <user@example.net>
Newsgroups	comp.lang.php
Subject	Re: scylldb and php? anyone building a site with them on archlinux?
Date	2019-11-10 11:15 +0100
Message-ID	<h2q6a5FkqgjU1@mid.individual.net> (permalink)
References	(4 earlier) <h2o6b0F8712U1@mid.individual.net> <h2ok2bFb335U1@mid.individual.net> <h2oulfFd6g4U1@mid.individual.net> <h2q3eiFk8p5U1@mid.individual.net> <h2q5ceFkkf5U1@mid.individual.net>

Show all headers | View raw

On 10/11/2019 10.59, Arno Welzel wrote:
> J.O. Aho:
> 
>> On 09/11/2019 23.58, Arno Welzel wrote:
> [...]
>>> Sure - but what vulnerability of systemd could be exploited remotely so
>>> it is problem for webservers? I don't remember any.
>>
>> Here is a example of remote code execution vulnerability that systemd
>> had a couple of years ago:
>>
>> https://www.openwall.com/lists/oss-security/2017/06/27/8
>>
>> Sure it's not a simple attack, but if you have managed to get hold of a
>> machine in the network, some arp poisoning and you are able to start
>> execute code on machines which not up to date.
>>
>>
>> You also have this one from last year:
>>
>> https://meterpreter.org/cve-2018-15688-systemd-remote-code-execution/
>>
>> Also you would need taken control of a machine in the network.
> 
> Thanks for the references.
> 
> Indeed, this looks not good - but as you said: it's not a simple attack
> as the first vulnerability can only be exploited by having a server to
> communicate with a malicious nameserver of the attacker. Usually public
> servers just don't to that and even desktop machines of end users often
> just use the nameserver of the ISP or the router.

With some arp poisoning and your server would start talking with a 
malicious nameserver, as you server will most likely be in a DC where 
you may have a number of other machines in the same network, just one of 
those needs to be compromised first and that way it could spread.

Even if this ain't rocket-science, it won't be a script kid who would 
preform this kind of attack.


> The second one is more critical but as I understand it also not relevant
> for public servers.

This is quite relevant for virtual machines, which gets their ip from 
the dhcp service, as this is the simplest way to administrate the ip 
addresses in a cloudplatform.


>> If you compare with any other init system, they never have had this kind
>> of security vulnerabilities, as they do not handle other  things than
>> initialize the system and those do not have the capability of sending
>> receiving data from an external source.
> 
> Sure.
> 
>> The only thing I can compare systemd when it comes to potential future
>> vulnerabilities is the worst of microsoft windows xp vulnerabilities,
>> where someone could become a super-administrator (there been this kind
>> of vulnerabilities in later versions of microsoft windows, but far less
>> and there are some built in measures to try to prevent these which
>> completely lacks in systemd).
> 
> Even Microsoft learned their lessons and I dont't see why systemd should
> get worse than it is.

systemd keeps on eating up other projects, so systemd grows and gets 
more potential attack vectors. Had it avoided to handle network traffic, 
time keeping, name lookup, it would be more safe even if there was 
vulnerabilities as then you would need to be local user.

-- 

  //Aho

Thread

scylldb and php?  anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-11-04 20:04 -0800
  Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-05 07:03 +0100
    Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-11-04 22:14 -0800
      Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-05 18:34 +0100
        Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-11-06 12:22 -0800
          Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-07 06:57 +0100
            Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-11-07 05:35 -0800
              Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-07 21:49 +0100
                Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-12-26 14:22 -0800
    Re: scylldb and php? anyone building a site with them on archlinux? Arno Welzel <usenet@arnowelzel.de> - 2019-11-08 01:54 +0100
      Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-08 06:46 +0100
        Re: scylldb and php? anyone building a site with them on archlinux? Arno Welzel <usenet@arnowelzel.de> - 2019-11-09 17:03 +0100
          Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-09 20:58 +0100
            Re: scylldb and php? anyone building a site with them on archlinux? Arno Welzel <usenet@arnowelzel.de> - 2019-11-09 23:58 +0100
              Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-10 10:26 +0100
                Re: scylldb and php? anyone building a site with them on archlinux? Arno Welzel <usenet@arnowelzel.de> - 2019-11-10 10:59 +0100
                Re: scylldb and php? anyone building a site with them on archlinux? "J.O. Aho" <user@example.net> - 2019-11-10 11:15 +0100
                Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-12-26 14:25 -0800
                Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-12-26 14:25 -0800
                Re: scylldb and php? anyone building a site with them on archlinux? Arno Welzel <usenet@arnowelzel.de> - 2019-12-30 15:28 +0100
      Re: scylldb and php? anyone building a site with them on archlinux? Azathoth Hastur <azathothhaster@gmail.com> - 2019-12-26 14:23 -0800
  Re: scylldb and php? anyone building a site with them on archlinux? Härra Rabmo <he12091983@gmail.com> - 2022-07-08 06:45 -0700

csiph-web