Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235)

[Filip Palian <s3810 () pjwstk edu pl>]

2015-01-27 18:05 GMT+00:00 Florian Weimer <fw () deneb enyo de>:
> * Marek Kroemeke:
>
> > We just noticed CVE-2015-0235 , and we thought we will drop this one
> > in - apologies for low quality , we didn't really have time yet to
> > analyse it, but it seems to be related, so it makes sense to patch
> > things once right ?
>
> It's not related, and we cannot patch it at the same time because
> packages for the gethostbyname issue are already ready, they just have
> to be released.  (When we change critical system components, we also
> need to be extra-careful with testing, which takes time.)

We have no access to vendor list, thus we had no prior knowledge if
the fixes are ready or not.

In our opinion it is related to CVE-2015-0235 for couple of reasons.
It would be rather pointless to name them all here as someone else
still would have a different opinion, understood.

Dunno about the glibc 2.15 but the bug can be triggered with
"libc6:i386 2.13-38+deb7u7".  So again, the patches exist but the most
recent packages are affected.

Many smart and more experienced members of this list may be interested
in analyzing this bug. Maybe it's only a regular bug, which can be
considered DoS at most in some circumstances or maybe there's more
than meets the eye. Hard to tell without in-depth analysis a la Qualys
one (by the report one can see how much effort it requires to reach
that level of honesty).

Thanks Florian for an initial skim through the code.


F



> Andreas Schwab fixed this in 2011:
>
>   <https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=2e96f1c7>
>
> If I'm not mistaken, this commit when into glibc 2.15.
>
> I have not yet found the corresponding glibc bug (if it exists).
>
> The bug only materializes if the getaddrinfo functions is called with
> the AI_IDN flag, and if glibc has been compiled with libidn support
> (but I haven't checked if you can switch that off these days).