[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CALoOobPZ9D+TYTE=EtU8pRMdN-YqwkhhZNDYEMO7Fo_As208-A@mail.gmail.com>
Date: Wed, 28 Jan 2015 22:20:18 -0800
From: Paul Pluzhnikov <ppluzhnikov@...il.com>
To: oss-security@...ts.openwall.com
Cc: yunlian@...gle.com
Subject: Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235)
On Wed, Jan 28, 2015 at 3:04 AM, Hanno Böck <hanno@...eck.de> wrote:
> I'm CC-ing the committer. Maybe we can shed some light on this.
>
> Two people having fixed this in different places without crying alarm -
> it's worrying.
I used to maintain GLIBC that is used in Google production.
An internal bug report (b/14129807) was filed on 2014/04/17 when a
Googler noticed that gethostname("000...0") (with a 1000 zeros)
resulted in a buffer overflow detected by address sanitizer.
I didn't investigate whether the bug is exploitable or not (I just
assume that all buffer overflows should be patched). I simply noticed
that upstream has already fixed the issue, and so we backported the
patch as we routinely do for other buffer overflows.
Chromium team also got notified about the internal bug, and applied
the patch as well.
If I was supposed to cry alarm, I would have to cry alarm every time
there is a buffer overflow in glibc, which doesn't seem very useful.
Cheers,
--
Paul Pluzhnikov
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
