Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 28 Jan 2015 13:39:18 +1300
From: Amos Jeffries <>
Subject: Re: Qualys Security Advisory CVE-2015-0235 - GHOST:
 glibc gethostbyname buffer overflow

Hash: SHA1

On 28/01/2015 7:20 a.m., Qualys Security Advisory wrote:
> On Tue, Jan 27, 2015 at 09:20:21AM -0800, Michal Zalewski wrote:
>> Nice work - thanks for the thoroughly investigated and detailed
>> advisory.
> Thank you very much. We also sincerely regret that some
> information about this vulnerability was leaked a few hours before
> the Coordinated Release Date (Time, in this particular case).
>> you be willing to publish the list of the reviewed
>> implementations to reduce the amount of repeated work?
> Here is a list of potential targets that we investigated (they all
> call gethostbyname, one way or another), but to the best of our
> knowledge, the buffer overflow cannot be triggered in any of them:
> apache, cups, dovecot, gnupg, isc-dhcp, lighttpd, mariadb/mysql, 
> nfs-utils, nginx, nodejs, openldap, openssh, postfix, proftpd, 
> pure-ftpd, rsyslog, samba, sendmail, sysklogd, syslog-ng,
> tcp_wrappers, vsftpd, xinetd.

You can add squid, its bundled plugin helpers, squidpurge, and
cachemgr.cgi to that list as not vulnerable. gethostbyname() use is
protected by filters on remotely provided inputs.

The squidclient tool version 3.0 and older may be vulnerable if the
bad value is provided through the command line -l  or -h parameters.
This may be a problem for any scripted products using the tool as a
backend. Version 3.1 and newer of this tool are not vulnerable.

Amos Jeffries
Squid Software Foundation

Version: GnuPG v2.0.22 (MingW32)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.