[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.LNX.4.64.1501281236560.9171@beijing.mitre.org>
Date: Wed, 28 Jan 2015 13:03:41 -0500 (EST)
From: cve-assign@...re.org
To: Huzaifa Sidhpurwala <huzaifas@...hat.com>
cc: oss-security@...ts.openwall.com,
Mitre CVE assign department <cve-assign@...re.org>
Subject: Re: GHOST gethostbyname() heap overflow in glibc
(CVE-2015-0235)
On Wed, 28 Jan 2015, Huzaifa Sidhpurwala wrote:
> On 01/27/2015 11:35 PM, Florian Weimer wrote:
>> * Marek Kroemeke:
>>
>>> We just noticed CVE-2015-0235 , and we thought we will drop this one
>>> in - apologies for low quality , we didn't really have time yet to
>>> analyse it, but it seems to be related, so it makes sense to patch
>>> things once right ?
>>
>> It's not related, and we cannot patch it at the same time because
>> packages for the gethostbyname issue are already ready, they just have
>> to be released. (When we change critical system components, we also
>> need to be extra-careful with testing, which takes time.)
>>
>> Andreas Schwab fixed this in 2011:
>>
>> <https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=2e96f1c7>
>>
>> If I'm not mistaken, this commit when into glibc 2.15.
>>
>> I have not yet found the corresponding glibc bug (if it exists).
>>
>> The bug only materializes if the getaddrinfo functions is called with
>> the AI_IDN flag, and if glibc has been compiled with libidn support
>> (but I haven't checked if you can switch that off these days).
>>
>
> MITRE,
>
> This is a new flaw, can you please assign a CVE id to this?
>
> https://bugzilla.redhat.com/show_bug.cgi?id=797096
>
> Thanks!
>
> --
> Huzaifa Sidhpurwala / Red Hat Product Security Team
Use CVE-2012-6686 for "unbound alloca use in glob_in_dir" as covered by
Red Hat Bugzilla ID 797096.
How is 797096 related to the 2e96f1c7 commit? The 2e96f1c7 commit does
not appear to be directly related to alloca usage; it concentrates on
setting "malloc_name = true" in gaih_inet(). However, a submitted patch
for Bugzilla 797096
(https://bugzilla.redhat.com/attachment.cgi?id=583711&action=diff)
performs includes much more extensive changes to gaih_inet(), modifies
other functions, and omits the "name = p;" logic that is used in 2e96f1c7.
Also, 797096 is marked as "closed" and points to RHBA-2013:0022-2, which
references CVE-2013-4357, which is RH Bug 1009643, which says "glibc:
stack overflow in getaddrinfo()'s use of alloca()."
---
CVE assignment team, MITRE CVE Numbering Authority M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
