6 ms·

To be fair, http://en.wikipedia.org/wiki/TUX_web_server http://en.wikipedia.org/wiki/TUX_web_server. Having said that, this is huge. This is way worse than Hear

To be fair, http://en.wikipedia.org/wiki/TUX_web_server http://en.wikipedia.org/wiki/TUX_web_server. Having said that, this is huge. This is way worse than Heartbleed for the IIS crowd.

psibi 12y ago
From the linked page: "TUX has never been an integrated part of the official Linux kernel, although it has been shipped in some distributions, notably Red Hat, SuSE and Fedora."
- IgorPartola 12y ago
  Sure. My point is that Microsoft isn't the entity to put a web server (or at least components of one) in the kernel. Some may look at it and laugh about how silly that idea is, but in reality many have tried it.
  - na85 12y ago
    Yep. Another reason folks are against systemd, as it also includes a baked-in http server. Systemd is also poised to become a veritable "second kernel" on linux systems and nobody seems to care enough to stop it.
    - psibi 12y ago
      Isn't systemd an user space process ?
      - na85 12y ago
        Yes. It's still on track to becoming a second kernel.
        4ydx 12y ago
        I agree that systemd is a bad idea in the sense that they are doing too much all at once. It is a fine level of arrogance to assume that there wont be problems along the way :P That being said this thread is about the poor souls who are running IIS servers.
tribaal 12y ago
And how much internet-facing web content is served with this toy webserver exactly? That's what I thought, none (except maybe the author's blog? wild guess).
- deleted 12y ago
  [deleted]
  - tribaal 12y ago
    From that very link, they use IIS (what this CVE is about), not a linux kernel-space http server.
- icebraining 12y ago
  except maybe the author's blog? wild guess Nope, Ingo Mólnar uses Google+ for his occasional blogging (though the last post seems to be from 2013).
  - tribaal 12y ago
    Haha, I knew somebody would actually look it up :) Thank you!
nbevans 12y ago
It really isn't. OpenSSL's heartbleed was incredibly hard to patch because of the sheer number of products that link to the OpenSSL libraries. It required painstaking effort to ensure everything was running the latest releases. And the severity of Heartbleed was such that all encrypted information could be deciphered. Whereas this problem... is a simple server crash that can be fixed by running a Windows Update. Not even on the same scale of vulnerability.
- endian01 12y ago
  I personally worried about the simplicity of the attack. Granted at this stage, its just a DoS, but then take corporate patch cycles into account.. In reality, most aren't going to get patched, at best, for another week or so. Security is still second-fiddle at many companies.

To be fair, http://en.wikipedia.org/wiki/TUX_web_server http://en.wikipedia.org/wiki/TUX_web_server. Having said that, this is huge. This is way worse than Heartbleed for the IIS crowd.

psibi 12y ago

From the linked page: "TUX has never been an integrated part of the official Linux kernel, although it has been shipped in some distributions, notably Red Hat, SuSE and Fedora."

IgorPartola 12y ago
Sure. My point is that Microsoft isn't the entity to put a web server (or at least components of one) in the kernel. Some may look at it and laugh about how silly that idea is, but in reality many have tried it.
- na85 12y ago
  Yep. Another reason folks are against systemd, as it also includes a baked-in http server. Systemd is also poised to become a veritable "second kernel" on linux systems and nobody seems to care enough to stop it.
  - psibi 12y ago
    Isn't systemd an user space process ?
    - na85 12y ago
      Yes. It's still on track to becoming a second kernel.
      - 4ydx 12y ago
        I agree that systemd is a bad idea in the sense that they are doing too much all at once. It is a fine level of arrogance to assume that there wont be problems along the way :P That being said this thread is about the poor souls who are running IIS servers.

tribaal 12y ago

And how much internet-facing web content is served with this toy webserver exactly? That's what I thought, none (except maybe the author's blog? wild guess).

deleted 12y ago
[deleted]
- tribaal 12y ago
  From that very link, they use IIS (what this CVE is about), not a linux kernel-space http server.
icebraining 12y ago
except maybe the author's blog? wild guess Nope, Ingo Mólnar uses Google+ for his occasional blogging (though the last post seems to be from 2013).
- tribaal 12y ago
  Haha, I knew somebody would actually look it up :) Thank you!

nbevans 12y ago

It really isn't. OpenSSL's heartbleed was incredibly hard to patch because of the sheer number of products that link to the OpenSSL libraries. It required painstaking effort to ensure everything was running the latest releases. And the severity of Heartbleed was such that all encrypted information could be deciphered. Whereas this problem... is a simple server crash that can be fixed by running a Windows Update. Not even on the same scale of vulnerability.

endian01 12y ago
I personally worried about the simplicity of the attack. Granted at this stage, its just a DoS, but then take corporate patch cycles into account.. In reality, most aren't going to get patched, at best, for another week or so. Security is still second-fiddle at many companies.