[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <54C9EC51.7060002@mittwald.de>
Date: Thu, 29 Jan 2015 09:16:17 +0100
From: Sven Kieske <s.kieske@...twald.de>
To: <oss-security@...ts.openwall.com>
Subject: Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235)
On 29/01/15 07:20, Paul Pluzhnikov wrote:
> If I was supposed to cry alarm, I would have to cry alarm every time
> there is a buffer overflow in glibc, which doesn't seem very useful.
Well as someone who is very careful, I _would_ consider every buffer
overflow a security risk unless proven otherwise.
It's unexpected behaviour, isn't it?
It's up to the surrounding systems such as ASLR to mitigate it.
But neither is ASLR deployed everywhere, nor is it a silver bullet
to solve the problem.
But I don't want to really reiterate this discussion.
All possible opinions on this topic have already been stated.
--
Mit freundlichen Grüßen / Regards
Sven Kieske
Systemadministrator
Mittwald CM Service GmbH & Co. KG
Königsberger Straße 6
32339 Espelkamp
T: +49-5772-293-100
F: +49-5772-293-333
https://www.mittwald.de
Geschäftsführer: Robert Meyer
St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217, HRA 6640, AG Bad Oeynhausen
Komplementärin: Robert Meyer Verwaltungs GmbH, HRB 13260, AG Bad Oeynhausen
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
