Date: Sat, 23 Oct 2010 03:08:30 +0400 From: Solar Designer <solar@...nwall.com> To: owl-users@...ts.openwall.com, announce@...ts.openwall.com Subject: glibc bugs: not in Owl Hi, In case some of you are wondering why there's no glibc security update for Owl when almost all major distros are releasing critical security updates now, the answer is simple: Owl is not vulnerable to CVE-2010-3847 and CVE-2010-3856 (both discovered by Tavis Ormandy). This is for several reasons, including due to glibc source code hardening we introduced many years ago (the "sanitize-env" patch). For some context, here are Tavis' postings on the bugs: http://lists.openwall.net/full-disclosure/2010/10/18/7 http://lists.openwall.net/full-disclosure/2010/10/22/15 Similarly not vulnerable are ALT Linux distributions, who have forward-ported the "sanitize-env" changes to newer versions of glibc: http://www.altlinux.com I am not aware of other Linux distros reusing our glibc hardening code, so any other distro with glibc 2.4+ should be presumed vulnerable... Meanwhile, we've introduced security fixes to some PAM modules not used on Owl by default, and we've updated many packages since the last ISO snapshot (binutils, hdparm, ed, man-pages, diffstat, flex, ncurses, VIM, and Linux-PAM): http://www.openwall.com/Owl/CHANGES-current.shtml ...and there's now an RSS feed on that page (for the change log). There's no new ISO snapshot yet, though. When there is, it will contain these updates and more (to be announced separately). Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.