3 ms·
Here is the full Qualys report with an in-depth analysis: http://www.openwall.com/lists/oss-security/2015/01/27/9 http://www.openwall.com/lists/oss-security/20
by 0x0 12y ago
Here is the full Qualys report with an in-depth analysis:
http://www.openwall.com/lists/oss-security/2015/01/27/9 http://www.openwall.com/lists/oss-security/2015/01/27/9
Also contains a writeup about a remote Exim exploit (which is the default mail server on at least Debian).
- jameskilton 12y agoFrom this, the vulnerability was fixed in May 2013 so any systems from there or later (e.g. Ubuntu 14.04) are fine. Older systems obviously now need to wait for the patches to come through.
- danielweber 12y agoIf you are looking for date-based checking[1], August 2013 is when glibc 2.18 was released.[2] [1] I wouldn't. [2] http://ftp.gnu.org/gnu/glibc/ http://ftp.gnu.org/gnu/glibc/
- yk 12y agoMost importantly, it contains a test program at the beginning of section 4.
- deleted 12y ago[deleted]
- asveikau 12y ago101 *buffer_size = size_needed; 102 new_buf = (char *) realloc (*buffer, *buffer_size); 103 104 if (new_buf == NULL) 105 { ... 114 goto done; 115 } It's a shame they put that "..." there, because this looked like another potential vulnerability to me, or at least something I would take very critically reading this code. (realloc fails, the caller's variable at buffer_size still gets assigned a larger value, next call thinks it has a larger buffer than it does). Line 110 assigns *buffer_size back to 0 so there is no such problem.