oss-sec mailing list archives

Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow

From: Amos Jeffries <squid3 () treenet co nz>
Date: Wed, 28 Jan 2015 13:39:18 +1300

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 28/01/2015 7:20 a.m., Qualys Security Advisory wrote:

On Tue, Jan 27, 2015 at 09:20:21AM -0800, Michal Zalewski wrote:

Nice work - thanks for the thoroughly investigated and detailed
advisory.


Thank you very much. We also sincerely regret that some
information about this vulnerability was leaked a few hours before
the Coordinated Release Date (Time, in this particular case).

you be willing to publish the list of the reviewed
implementations to reduce the amount of repeated work?


Here is a list of potential targets that we investigated (they all
call gethostbyname, one way or another), but to the best of our
knowledge, the buffer overflow cannot be triggered in any of them:

apache, cups, dovecot, gnupg, isc-dhcp, lighttpd, mariadb/mysql, 
nfs-utils, nginx, nodejs, openldap, openssh, postfix, proftpd, 
pure-ftpd, rsyslog, samba, sendmail, sysklogd, syslog-ng,
tcp_wrappers, vsftpd, xinetd.


You can add squid, its bundled plugin helpers, squidpurge, and
cachemgr.cgi to that list as not vulnerable. gethostbyname() use is
protected by filters on remotely provided inputs.

The squidclient tool version 3.0 and older may be vulnerable if the
bad value is provided through the command line -l  or -h parameters.
This may be a problem for any scripted products using the tool as a
backend. Version 3.1 and newer of this tool are not vulnerable.

Amos Jeffries
Squid Software Foundation

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (MingW32)

iQEbBAEBAgAGBQJUyC+1AAoJELJo5wb/XPRjg1oH+JJdmbB877JAmSp/ETTfaj6Z
2UdHKe5zMlgqHkU8kz8H5PpGPGMrPOvUQWSoUp+o9iUndmK9vDXauuojGdHMJI5c
Vl5LQ4kIeSBC7uHvsbRneu8CoYEn8FrvubGuAz2Uq3nmDNCWVdQ5j0OCAhApqOTo
VX5wIuxginW/0nFmRBJ8q81iFXqCD058XkCG7r6ulGvk1/AUtqUq9wuKNBG2Ov08
ELG9zCqxqk+N/NRyi1MrCTQccGieVE+kmeyCRsVsERoJlPLXlADt6j41Szj/Qdkm
K4Lkq9pvBf722cuepr62LgJGyJX9D3YK+LmQk6zK8BdE/PIa9seniH+upxv8sQ==
=dj7r
-----END PGP SIGNATURE-----

Current thread:

Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow Qualys Security Advisory (Jan 27)
- Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow Michal Zalewski (Jan 27)
  - Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow Qualys Security Advisory (Jan 27)
    - Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow Michal Zalewski (Jan 27)
    - Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow Stephane Chazelas (Jan 28)
    - Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow Amos Jeffries (Jan 27)
    - Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow Sven Kieske (Jan 28)
    - Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow Qualys Security Advisory (Jan 29)
    - Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow Solar Designer (Jan 29)