Magnitude of glibc Vulnerability Coming To Light (threatpost.com)

Posted by timothy on Thursday February 18, 2016 @03:02AM from the low-level-errors dept.

msm1267 writes: The glibc vulnerability disclosed this week has some experts on edge because of how DNS can leveraged in exploits. Dan Kaminsky said that while man-in-the-middle attacks are one vector, it would appear that it's also possible to exploit the bug and attack most Linux servers via DNS caching-only servers. 'This would be substantially worse if it went through the caching ecosystem; 99 percent of attack vectors go through that system,' Kaminsky said. Glibc, or the GNU C library, is used by most flavors of Linux and also a number of popular web services and frameworks, giving attacks potentially massive horizontal scale. The major Linux distros have patched and pushed updates to servers; source code is also available for homegrown Linux builds.

1 of 139 comments (clear)

Min score:

Reason:

Sort:

Re:Hands up by Anonymous Coward · 2016-02-18 07:58 · Score: 2, Informative

However as this is a Linux vulnerability, it was openly discussed and it was fixed at once.
There, FTFY.
It was disclosed in July last year. That doesn't meet my definition of "at once".
https://sourceware.org/bugzilla/show_bug.cgi?id=18665