[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20150130230812.GO4574@brightrain.aerifal.cx>
Date: Fri, 30 Jan 2015 18:08:12 -0500
From: Rich Felker <dalias@...c.org>
To: oss-security@...ts.openwall.com
Subject: Re: the other glibc issue
On Thu, Jan 29, 2015 at 11:50:23AM +0300, Solar Designer wrote:
> Oh, can we use descriptive Subjects, please? (I am leaving this one
> intact not to introduce even further confusion.)
>
> On Wed, Jan 28, 2015 at 01:17:40PM -0500, cve-assign@...re.org wrote:
> > Use CVE-2013-7423 for ths initial bug report at 2013-09-12 09:50:17 UTC
> > stating: "Under high load, getaddrinfo() starts sending DNS queries to
> > random file descriptors, e.g. some unrelated socket connected to a remote
> > service."
> >
> > Which comment says that the issue is unfixed? The 2015-01-08 14:21:11 UTC
> > comment by David Nilsson says "I'm unable to reproduce the correct
> > behaviour," but does not suggest that the vulnerability is still present.
>
> That comment you mention seemed to imply that, but here are the news off
> Twitter:
>
> <solardiz> glibc "getaddrinfo() writes DNS queries to random file descriptors under high load" https://sourceware.org/bugzilla/show_bug.cgi?id=15946 "Fixed in 2.20", reopened, CVE?
> <@RichFelker> @solardiz Yeah I've been following this and pushing for it to be taken seriously for a long time...
> <@RichFelker> @solardiz Looks like a false positive, a bug in the testcase rather than in #glibc. See https://sourceware.org/ml/glibc-bugs/2015-01/msg00226.html
> <@solardiz> @RichFelker To me, this message says that the bug still being reproducible on glibc 2.20 is a false positive, but the fix in 2.20 was needed
> <@solardiz> @RichFelker Someone should run the corrected testcase on pre-2.20 to see if the issue was reproducible before the fix or not
>
> So glibc 2.20 appears OK, and we need to re-test older glibc - but from
> the patch it looks like there was indeed this bug before 2.20.
I followed up on the bug tracker, and Jiri Hruska reports having
tested the fixed testcase against the pre-fix glibc and is correctly
detects the original bug. See:
https://sourceware.org/ml/glibc-bugs/2015-01/msg00273.html
Rich
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
