oss-sec mailing list archives
Re: darkhttpd: timing attack and local leak of HTTP basic auth credentials
From: Johannes Segitz <jsegitz () suse de>
Date: Wed, 24 Jan 2024 09:19:00 +0100
On Wed, Jan 24, 2024 at 08:42:35AM +0100, Hanno Böck wrote:
I think it would be desirable that Linux distributions start using hidepid and mitigate the whole class of bugs like the one mentioned above.
I agree with you. Unfortunately this is next to impossible based on my experience. We can get something like this into "hardened" configurations, but enabling this in the default configuration will not work as there are always (important) customers that will not accept it. I believe we'll have to live with these issues for a long time :( Johannes -- GPG Key EE16 6BCE AD56 E034 BFB3 3ADD 7BF7 29D5 E7C8 1FA0 Subkey fingerprint: 250F 43F5 F7CE 6F1E 9C59 4F95 BC27 DD9D 2CC4 FD66 SUSE Software Solutions Germany GmbH, Frankenstraße 146, 90461 Nürnberg, Germany Geschäftsführer: Ivo Totev, Andrew McDonald, Werner Knoblich (HRB 36809, AG Nürnberg)
Attachment:
signature.asc
Description: Digital signature
Current thread:
- darkhttpd: timing attack and local leak of HTTP basic auth credentials Matthias Gerstner (Jan 23)
- Re: darkhttpd: timing attack and local leak of HTTP basic auth credentials Hanno Böck (Jan 23)
- Re: darkhttpd: timing attack and local leak of HTTP basic auth credentials Johannes Segitz (Jan 24)
- Re: darkhttpd: timing attack and local leak of HTTP basic auth credentials nightmare . yeah27 (Jan 24)
- Re: Re: darkhttpd: timing attack and local leak of HTTP basic auth credentials Anton Luka Šijanec (Jan 24)
- Re: darkhttpd: timing attack and local leak of HTTP basic auth credentials Johannes Segitz (Jan 24)
- systemd and other system services (in)compatibility with Linux procfs hidepid (was: darkhttpd: timing attack and local leak of HTTP basic auth credentials) Solar Designer (Feb 02)
- Re: darkhttpd: timing attack and local leak of HTTP basic auth credentials Hanno Böck (Jan 23)
- Re: darkhttpd: timing attack and local leak of HTTP basic auth credentials Matthias Gerstner (Jan 25)