4 ms·
>A remote code execution vulnerability exists in the HTTP protocol stack [...] could execute arbitrary code in the context of the System account. SYSTEM is hig
by kpcyrd 12y ago
>A remote code execution vulnerability exists in the HTTP protocol stack [...] could execute arbitrary code in the context of the System account.
SYSTEM is higher than admin. Using IIS on windows is like running a webserver as root on linux.
- aninteger 12y agoOnly at the HTTP parsing stage.. Once you get into ASP.net you'll have dropped privileges.
- rst 12y agoTypical Linux servers drop privileges before accepting any connections from clients, precisely to limit the scope of this sort of vulnerability.
- drzaiusapelord 12y agoLets not play the "my team is better than your team" hysterics, especially when we all had to do emergency patching for shellshock, heartbleed, samba, drupal, etc in the past couple months. Hell, sambra runs as root and that doesn't seem to outrage anyone.
- xorcist 12y agoSamba doesn't run as a kernel module though. I suspect such a patch would not get far, just as many ridiculed the TUX web server some fifteen years ago.