[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20150129235224.GA9204@openwall.com>
Date: Fri, 30 Jan 2015 02:52:24 +0300
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow
On Tue, Jan 27, 2015 at 10:20:20AM -0800, Qualys Security Advisory wrote:
> Here is a list of potential targets that we investigated (they all call
> gethostbyname, one way or another), but to the best of our knowledge,
> the buffer overflow cannot be triggered in any of them:
>
> apache, cups, dovecot, gnupg, isc-dhcp, lighttpd, mariadb/mysql,
> nfs-utils, nginx, nodejs, openldap, openssh, postfix, proftpd,
> pure-ftpd, rsyslog, samba, sendmail, sysklogd, syslog-ng, tcp_wrappers,
> vsftpd, xinetd.
>
> That being said, we believe it would be interesting if other people
> could have a look, just in case we missed something.
That's an impressive list above, thanks!
To add on the topic and aggregate the relevant news in this thread:
Today there's some talk about GHOST possibly being exploitable via web
apps, and in particular via the pingback feature in WordPress:
http://threatpost.com/php-applications-wordpress-subject-to-ghost-glibc-vulnerability/110755
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
