Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 28 Jan 2015 22:20:18 -0800
From: Paul Pluzhnikov <ppluzhnikov@...il.com>
To: oss-security@...ts.openwall.com
Cc: yunlian@...gle.com
Subject: Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235)

On Wed, Jan 28, 2015 at 3:04 AM, Hanno Böck <hanno@...eck.de> wrote:

> I'm CC-ing the committer. Maybe we can shed some light on this.
>
> Two people having fixed this in different places without crying alarm -
> it's worrying.

I used to maintain GLIBC that is used in Google production.

An internal bug report (b/14129807) was filed on 2014/04/17 when a
Googler noticed that gethostname("000...0") (with a 1000 zeros)
resulted in a buffer overflow detected by address sanitizer.

I didn't investigate whether the bug is exploitable or not (I just
assume that all buffer overflows should be patched). I simply noticed
that upstream has already fixed the issue, and so we backported the
patch as we routinely do for other buffer overflows.

Chromium team also got notified about the internal bug, and applied
the patch as well.

If I was supposed to cry alarm, I would have to cry alarm every time
there is a buffer overflow in glibc, which doesn't seem very useful.

Cheers,

-- 
Paul Pluzhnikov

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ