Re: [Vserver] Util-VServer in @RISK The Consensus Security Vulnerability Alert Vol. 5 No. 14

From: Daniel Hokka Zakrisson <>
Date: Wed 19 Apr 2006 - 22:03:19 BST
Message-ID: <>

Roderick A. Anderson wrote:
> I noticed that Util-Vserver was reported with a SUEXEC Privilege
> Escalation Weakness in the April 10 report.
> I found nothing on the list about this back as far as late February. Is
> this report FUD, not worth worrying about, or I missed the whole thread
> on the list?
> ( )
> In an odd way this is good since the other virtualization packages get
> more publicity. :-(

It was discussed on IRC. How anyone can consider the host root entering
a guest and executing a command as root as privilege escalation is
beyond me (when in reality, you are dropping lots of capabilities,
filesystem access, etc.).

Daniel Hokka Zakrisson
GPG id: 06723412
GPG fingerprint: A455 4DF3 990A 431F FECA  7947 6136 DDA2 0672 3412
Vserver mailing list
Received on Wed Apr 19 22:03:33 2006
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 19 Apr 2006 - 22:03:36 BST by hypermail 2.1.8