Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 29 Jan 2015 09:16:17 +0100
From: Sven Kieske <s.kieske@...twald.de>
To: <oss-security@...ts.openwall.com>
Subject: Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235)

On 29/01/15 07:20, Paul Pluzhnikov wrote:
> If I was supposed to cry alarm, I would have to cry alarm every time
> there is a buffer overflow in glibc, which doesn't seem very useful.

Well as someone who is very careful, I _would_ consider every buffer
overflow a security risk unless proven otherwise.

It's unexpected behaviour, isn't it?
It's up to the surrounding systems such as ASLR to mitigate it.
But neither is ASLR deployed everywhere, nor is it a silver bullet
to solve the problem.

But I don't want to really reiterate this discussion.
All possible opinions on this topic have already been stated.
-- 
Mit freundlichen Grüßen / Regards

Sven Kieske

Systemadministrator
Mittwald CM Service GmbH & Co. KG
Königsberger Straße 6
32339 Espelkamp
T: +49-5772-293-100
F: +49-5772-293-333
https://www.mittwald.de
Geschäftsführer: Robert Meyer
St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217, HRA 6640, AG Bad Oeynhausen
Komplementärin: Robert Meyer Verwaltungs GmbH, HRB 13260, AG Bad Oeynhausen

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.