[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150129164849.GA2310@localhost.localdomain>
Date: Thu, 29 Jan 2015 08:48:49 -0800
From: Qualys Security Advisory <qsa@...lys.com>
To: oss-security@...ts.openwall.com
Subject: Re: Qualys Security Advisory CVE-2015-0235 - GHOST:
glibc gethostbyname buffer overflow
Dear All,
We were asked off-list whether HAProxy is vulnerable to GHOST or not,
and thought others might be interested in the answer as well. The short
version is: HAProxy is NOT vulnerable to GHOST.
The slightly longer version is: we are looking for gethostbyname()
calls whose hostname argument can be controlled by an attacker. There
are indeed a few calls to gethostbyname() in HAProxy, but their hostname
arguments all depend on the configuration file, in the end, so they are
safe (side note: there is getaddrinfo() support too, but it seems to be
turned on for Solaris only, by default).
Hope this is useful. With best regards,
--
the Qualys Security Advisory team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
