[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 29 Jan 2015 02:05:38 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235)
On 29/01/15 01:16 AM, Sven Kieske wrote:
> On 29/01/15 07:20, Paul Pluzhnikov wrote:
>> If I was supposed to cry alarm, I would have to cry alarm every time
>> there is a buffer overflow in glibc, which doesn't seem very useful.
>
> Well as someone who is very careful, I _would_ consider every buffer
> overflow a security risk unless proven otherwise.
>
> It's unexpected behaviour, isn't it?
> It's up to the surrounding systems such as ASLR to mitigate it.
> But neither is ASLR deployed everywhere, nor is it a silver bullet
> to solve the problem.
>
> But I don't want to really reiterate this discussion.
> All possible opinions on this topic have already been stated.
So you'll be doing the work to confirm which ones are/are not, patch
them, regression test the patches and so on? Awesome!
There's a reason we don't treat every potential security flaw as a
security vulnerability. We have finite resources and pretty much an
infinite number of flaws to deal with. Until you solve that problem we
have to make due with "best effort", letting perfection be the enemy of
good will kill us.
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
