Hacker News Reader

>A remote code execution vulnerability exists in the HTTP protocol stack [...] could execute arbitrary code in the context of the System account.

SYSTEM is higher than admin. Using IIS on windows is like running a webserver as root on linux.

View on HN

Lets not play the "my team is better than your team" hysterics, especially when we all had to do emergency patching for shellshock, heartbleed, samba, drupal, etc in the past couple months. Hell, sambra runs as root and that doesn't seem to outrage anyone.

Samba doesn't run as a kernel module though.

I suspect such a patch would not get far, just as many ridiculed the TUX web server some fifteen years ago.

no, but cifs does; https://www.kernel.org/doc/readme/Documentation-filesystems-...

FWIW, only the client side of CIFS runs in the kernel. The server software (smbd) is entirely in userspace.

Only at the HTTP parsing stage.. Once you get into ASP.net you'll have dropped privileges.

Typical Linux servers drop privileges before accepting any connections from clients, precisely to limit the scope of this sort of vulnerability.

Reply on news.ycombinator.com