3 ms·
> Http.sys also seems like a more secure product than openssl How is a goddamn HTTP parser in THE KERNEL more secure than a crypto/TLS library? http.sys is a
by floatboth 10y ago
> Http.sys also seems like a more secure product than openssl
How is a goddamn HTTP parser in THE KERNEL more secure than a crypto/TLS library?
http.sys is a fundamentally horrendous idea, see CVE-2015-1635 https://technet.microsoft.com/library/security/MS15-034 https://technet.microsoft.com/library/security/MS15-034 An exploited HTTP parser shouldn't lead to RCE "in the context of the System account".
- drzaiusapelord 10y agoThat's mostly client-side and easily avoided by not using IE/Edge. .NET uses its own library as well I believe. Not sure what the default is. Historically, the schannel infrastructure has been secure, especially as compared to openssl. >How is a goddamn HTTP parser in THE KERNEL more secure than a crypto/TLS library? Because, lets face it, openssl is a shit project of legacy code no one wants to fix and https a design by committee standard no one can work well?
- floatboth 10y ago"an attacker would have to send a specially crafted HTTP request to the affected system" "Disable IIS kernel caching" That's definitely not client-side at all. IIS is the thing that uses http.sys, and classic ASP.NET apps (not the new Core stuff) are usually deployed with IIS.
- benaadams 10y agoThe .NET Core example in the article uses the ASP.NET Core Kestrel server which operates entirely in user mode.
- floatboth 10y agoI know about Kestrel, I'm responding to that particular phrase in the comment :)
- nikanj 10y agohttp.sys has ifdefs to support one platform, in one configuration. Meanwhile, https://mta.openssl.org/pipermail/openssl-dev/2015-January/000468.html https://mta.openssl.org/pipermail/openssl-dev/2015-January/0... The number of config permutations in openssl is staggering, and that has to have an effect on the overall test coverage - which probably affects the number of bug that pass through testing.