Date: Thu, 29 Jan 2015 09:16:17 +0100 From: Sven Kieske <s.kieske@...twald.de> To: <oss-security@...ts.openwall.com> Subject: Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) On 29/01/15 07:20, Paul Pluzhnikov wrote: > If I was supposed to cry alarm, I would have to cry alarm every time > there is a buffer overflow in glibc, which doesn't seem very useful. Well as someone who is very careful, I _would_ consider every buffer overflow a security risk unless proven otherwise. It's unexpected behaviour, isn't it? It's up to the surrounding systems such as ASLR to mitigate it. But neither is ASLR deployed everywhere, nor is it a silver bullet to solve the problem. But I don't want to really reiterate this discussion. All possible opinions on this topic have already been stated. -- Mit freundlichen Grüßen / Regards Sven Kieske Systemadministrator Mittwald CM Service GmbH & Co. KG Königsberger Straße 6 32339 Espelkamp T: +49-5772-293-100 F: +49-5772-293-333 https://www.mittwald.de Geschäftsführer: Robert Meyer St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217, HRA 6640, AG Bad Oeynhausen Komplementärin: Robert Meyer Verwaltungs GmbH, HRB 13260, AG Bad Oeynhausen
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ