Date: Tue, 27 Jan 2015 19:29:07 +0100 From: Sven Kieske <svenkieske@...il.com> To: oss-security@...ts.openwall.com Subject: Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 27.01.2015 19:20, Qualys Security Advisory wrote: > Here is a list of potential targets that we investigated (they all > call gethostbyname, one way or another), but to the best of our > knowledge, the buffer overflow cannot be triggered in any of them: > > apache, cups, dovecot, gnupg, isc-dhcp, lighttpd, mariadb/mysql, > nfs-utils, nginx, nodejs, openldap, openssh, postfix, proftpd, > pure-ftpd, rsyslog, samba, sendmail, sysklogd, syslog-ng, > tcp_wrappers, vsftpd, xinetd. > > That being said, we believe it would be interesting if other > people could have a look, just in case we missed something. Here is a potential list from openhub.net code search: https://code.openhub.net/search?p=0&s=gethostbyname&p=0 might be worth investigating kind regards Sven -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQGcBAEBAgAGBQJUx9jyAAoJEAq0kGAWDrqlzsIL/i3OzGxxgE8p0pf+wi34wmne Nq5yhNk42DHCExP1YfabDy41OobwXO9IdgT6zYqPQBM55N9dgyON+ph3lggw8psG UDGgA+o+plc2gBbFS/aLFLHM2ALqyn7oqTIgqD/Sw1gbiiYvgHp40PMwBYYcW56/ oPRletR9q4npOGkVxByskNS8+b0VaFbmwVg6CQMYiR8UyWLRoTILtMV0DWXlhkxU m6Qfo8kDNkR3lLi3n5tIkfTJsLF2NWWHiS4PDjc32JJahUjlIjyfBaHWs8T8KN6h clUHB3BV7rp3ZBw4STgPwz0OVHPsGGnsj9x4m3dX4kEk39SHewFfYrXAqO1o3vot Kfq3RTh/pesL6Ze/talnXS0KCYep7Jxi3lxIuNHoAI2VxKVbdTgEDBZlBuNLuz3H ABT627Gh6fAxtrtsdjU7AlsjDiEXRXt8YvgQUJJy5S89sdM3ewbhsl91sqOJTkYl W+nnngzcvOImxfxWn/A4xnGcstle3rsZ2gaeQBQkgA== =h6GH -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.