Is Gentoo affected?
CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow
61–70 of 254 posts
Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow
#62Glancing over the patch, this appears to be the crucial part: size_needed = (sizeof (*host_addr) - + sizeof (*h_addr_ptrs) + strlen (name) + 1); + + sizeof (*h_addr_ptrs) + + sizeof (*h_alias_ptr) + strlen (name) + 1); Doesn't it seem disappointing that some programmers, for whatever reason, just can't seem to count correctly?
There are only 2 really difficult problems in computer science: cache invalidation, naming things, and off-by-one errors.
Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow
#63Looks like that function is marked as obsolete, anyone know how long that's been the case? https://www.mankier.com/3/gethostbyname "The gethostbyname (), gethostbyaddr (), herror(), and hstrerror() functions are obsolete. Applications should use getaddrinfo(3), getnameinfo(3), and gai_strerror(3) instead."
For a long time: getaddrinfo() and others are specified in susv3[1] (since 2003 I think). However, gethostbyname() and gethostbyaddr() are still very commonly used, and won't be gone soon.
1/ http://refspecs.linuxbase.org/LSB_3.1.1/LSB-Core-generic/LSB...
Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow
#64Glancing over the patch, this appears to be the crucial part: size_needed = (sizeof (*host_addr) - + sizeof (*h_addr_ptrs) + strlen (name) + 1); + + sizeof (*h_addr_ptrs) + + sizeof (*h_alias_ptr) + strlen (name) + 1); Doesn't it seem disappointing that some programmers, for whatever reason, just can't seem to count correctly?
I have no idea if it would apply here, but many instances where a field is forgotten in a size calculation happen because the field wasn't originally there, and not all of the relevant code got updated when it was added. Beware any code that requires knowledge of all elements of some set, and still compiles if a new element is added and the code isn't updated for it.
Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow
#65Earlier quoted context omitted.
We disagree on that, especially when they're widespread (and you don't get much more widespread than glibc) and "drop everything and patch"-level severity. Having a shorthand to refer to the bug makes it more easy (and therefore more likely) that it will get referenced and discussed.
I think the parent comment was sarcastic.
I don't think so.
Between Heartbleed and Shellshock, and now this, a PR firm marketing vulnerabilities like this seems... crass.
Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow
#66If this was patched in 2013 why is it an issue now?
Because it was "silently" fixed so nobody applied the patch to existing, shipping systems.
From what I can gather, it wasn't originally thought to be a security vulnerability so it was thought to be acceptable to leave it be on older systems. Now somebody has figured out how to exploit it.
Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow
#67Here is the full Qualys report with an in-depth analysis: http://www.openwall.com/lists/oss-security/2015/01/27/9 Also contains a writeup about a remote Exim exploit (which is the default mail server on at least Debian).
Most importantly, it contains a test program at the beginning of section 4.
Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow
#68Is Gentoo affected?
No, the announcement [1] says the affected versions are:
> In particular, we discovered that it was fixed on May 21, 2013 (between the releases of glibc-2.17 and glibc-2.18)
Gentoo is listing glibc version 2.19-r1 as the latest stable version [2] and is using that per default.
Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow
#69Earlier quoted context omitted.
You can check to see if any running process are using any stale libraries pretty easily: sudo lsof | grep lib | grep DEL You can then either reload those processes manually, or just bounce the box if that's easier.
[deleted]
You're testing what happens when you delete a file for which an open file descriptor exists. On Linux, a shared library will normally be memory-mapped but will not have a corresponding file descriptor. So lsof will show DEL, not (deleted).
I wouldn't normally nitpick about something like this, but if people follow your advice they might incorrectly think they don't need to reboot.
Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow
#70Earlier quoted context omitted.
The Qualys security advisory says that it was fixed independently in 2013, so RHEL6 and 7 might already have the fix. http://www.openwall.com/lists/oss-security/2015/01/27/9
Yes, it was fixed upstream in glibc, but that doesn't mean the distros actually get the patch into their distribution. In fact, the report states: "Unfortunately, it was not recognized as a security threat; as a result, most stable and long-term-support distributions were left exposed (and still are): Debian 7 (wheezy), Red Hat Enterprise Linux 6 & 7, CentOS 6 & 7, Ubuntu 12.04, for example."
Oh yeah, that was obvious, not sure how I missed it. Thanks.