Re: CVE-2019-12522
"Eliezer Croitoru" <[email protected]> Fri, 4 Mar 2022 15:51:44 +0200
| Newsgroups | gmane.comp.web.squid.devel |
|---|---|
| Message-ID | <[email protected]> |
Thanks!! ---- Eliezer Croitoru NgTech, Tech Support Mobile: +972-5-28704261 Email: [email protected] -----Original Message----- From: squid-dev <[email protected]> On Behalf Of Amos Jeffries Sent: Friday, March 4, 2022 06:43 To: [email protected] Subject: Re: [squid-dev] CVE-2019-12522 On 4/03/22 00:39, Eliezer Croitoru wrote: > I'm still trying to understand why it's described as "exploitable" ??? > It's like saying: The Linux Kernel should not be a kernel and init(or > equivalent) should not run with uid 0 or 1. > Why nobody complains about cockpit being a root process?? > This explains the _type_ of problem <https://secureteam.co.uk/articles/how-return-oriented-programming-exploits- work/>. Most Squid are automatically protected against it by at least one of OS or compiler systems. But some can still be vulnerable, as shown by Jerkio. Amos _______________________________________________ squid-dev mailing list [email protected] http://lists.squid-cache.org/listinfo/squid-dev