Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 29 Jan 2015 09:16:17 +0100
From: Sven Kieske <s.kieske@...twald.de>
To: <oss-security@...ts.openwall.com>
Subject: Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235)

On 29/01/15 07:20, Paul Pluzhnikov wrote:
> If I was supposed to cry alarm, I would have to cry alarm every time
> there is a buffer overflow in glibc, which doesn't seem very useful.

Well as someone who is very careful, I _would_ consider every buffer
overflow a security risk unless proven otherwise.

It's unexpected behaviour, isn't it?
It's up to the surrounding systems such as ASLR to mitigate it.
But neither is ASLR deployed everywhere, nor is it a silver bullet
to solve the problem.

But I don't want to really reiterate this discussion.
All possible opinions on this topic have already been stated.
-- 
Mit freundlichen Grüßen / Regards

Sven Kieske

Systemadministrator
Mittwald CM Service GmbH & Co. KG
Königsberger Straße 6
32339 Espelkamp
T: +49-5772-293-100
F: +49-5772-293-333
https://www.mittwald.de
Geschäftsführer: Robert Meyer
St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217, HRA 6640, AG Bad Oeynhausen
Komplementärin: Robert Meyer Verwaltungs GmbH, HRB 13260, AG Bad Oeynhausen

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ