Re: GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235)

[Sven Kieske <s.kieske () mittwald de>]

On 29/01/15 07:20, Paul Pluzhnikov wrote:
> If I was supposed to cry alarm, I would have to cry alarm every time
> there is a buffer overflow in glibc, which doesn't seem very useful.

Well as someone who is very careful, I _would_ consider every buffer
overflow a security risk unless proven otherwise.

It's unexpected behaviour, isn't it?
It's up to the surrounding systems such as ASLR to mitigate it.
But neither is ASLR deployed everywhere, nor is it a silver bullet
to solve the problem.

But I don't want to really reiterate this discussion.
All possible opinions on this topic have already been stated.
-- 
Mit freundlichen Grüßen / Regards

Sven Kieske

Systemadministrator
Mittwald CM Service GmbH & Co. KG
Königsberger Straße 6
32339 Espelkamp
T: +49-5772-293-100
F: +49-5772-293-333
https://www.mittwald.de
Geschäftsführer: Robert Meyer
St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217, HRA 6640, AG Bad Oeynhausen
Komplementärin: Robert Meyer Verwaltungs GmbH, HRB 13260, AG Bad Oeynhausen