Date: Wed, 28 Jan 2015 22:20:18 -0800 From: Paul Pluzhnikov <ppluzhnikov@...il.com> To: oss-security@...ts.openwall.com Cc: yunlian@...gle.com Subject: Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) On Wed, Jan 28, 2015 at 3:04 AM, Hanno Böck <hanno@...eck.de> wrote: > I'm CC-ing the committer. Maybe we can shed some light on this. > > Two people having fixed this in different places without crying alarm - > it's worrying. I used to maintain GLIBC that is used in Google production. An internal bug report (b/14129807) was filed on 2014/04/17 when a Googler noticed that gethostname("000...0") (with a 1000 zeros) resulted in a buffer overflow detected by address sanitizer. I didn't investigate whether the bug is exploitable or not (I just assume that all buffer overflows should be patched). I simply noticed that upstream has already fixed the issue, and so we backported the patch as we routinely do for other buffer overflows. Chromium team also got notified about the internal bug, and applied the patch as well. If I was supposed to cry alarm, I would have to cry alarm every time there is a buffer overflow in glibc, which doesn't seem very useful. Cheers, -- Paul Pluzhnikov
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ