WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-users

Re: [Xen-users] patch for vanilla kernel


then you need to be using kernels that aren't 18 months out of date.
Humm... SQL Injections don't has any issue with kernels and the PHP fails
normally runs with low level privileges on system, it could... but it's not
likely to hit the kernel without huge efforts.

wtf? There are thousands of crappy php scripts out there that can be tricked into running arbitrary code ... add any one of the priviledge escalation vulnerabilities and the attacker can escalate "arbitrary code" into "root access".

Indeed, we all have to keep our systems secure, but this doesn't necessarily
means that we need to keep the latest bleeding-edge kernel version running.

I agree with you, that it IS possible to escalate privileges even with dumb
php scripts, but I disagree that newer kernel versions are tha best way to
fix those issues.

btw. I also found xensource's 2.6.18.8-xen *much* more stable than any xenified
kernel on 32bit as well as on 64bit.

for newer drivers a backport is always possible.

Stephan

Attachment: s_seitz.vcf
Description: Vcard

Attachment: signature.asc
Description: OpenPGP digital signature

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users