Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 29 Jan 2015 08:48:49 -0800
From: Qualys Security Advisory <qsa@...lys.com>
To: oss-security@...ts.openwall.com
Subject: Re: Qualys Security Advisory CVE-2015-0235 - GHOST:
 glibc gethostbyname buffer overflow

Dear All,

We were asked off-list whether HAProxy is vulnerable to GHOST or not,
and thought others might be interested in the answer as well.  The short
version is:  HAProxy is NOT vulnerable to GHOST.

The slightly longer version is:  we are looking for gethostbyname()
calls whose hostname argument can be controlled by an attacker.  There
are indeed a few calls to gethostbyname() in HAProxy, but their hostname
arguments all depend on the configuration file, in the end, so they are
safe (side note: there is getaddrinfo() support too, but it seems to be
turned on for Solaris only, by default).

Hope this is useful.  With best regards,

-- 
the Qualys Security Advisory team

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.