[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-users] patch for vanilla kernel




then you need to be using kernels that aren't 18 months out of date.
Humm... SQL Injections don't has any issue with kernels and the PHP fails
normally runs with low level privileges on system, it could... but it's not
likely to hit the kernel without huge efforts.

wtf? There are thousands of crappy php scripts out there that can be tricked into running arbitrary code ... add any one of the priviledge escalation vulnerabilities and the attacker can escalate "arbitrary code" into "root access".

Indeed, we all have to keep our systems secure, but this doesn't necessarily
means that we need to keep the latest bleeding-edge kernel version running.

I agree with you, that it IS possible to escalate privileges even with dumb
php scripts, but I disagree that newer kernel versions are tha best way to
fix those issues.

btw. I also found xensource's 2.6.18.8-xen *much* more stable than any xenified
kernel on 32bit as well as on 64bit.

for newer drivers a backport is always possible.

Stephan

Attachment: s_seitz.vcf
Description: Vcard

Attachment: signature.asc
Description: OpenPGP digital signature

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users

 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.