Slashdot Mirror

← Back to Stories (view on slashdot.org)

Magnitude of glibc Vulnerability Coming To Light (threatpost.com)

Posted by timothy on from the low-level-errors dept.

msm1267 writes: The glibc vulnerability disclosed this week has some experts on edge because of how DNS can leveraged in exploits. Dan Kaminsky said that while man-in-the-middle attacks are one vector, it would appear that it's also possible to exploit the bug and attack most Linux servers via DNS caching-only servers. 'This would be substantially worse if it went through the caching ecosystem; 99 percent of attack vectors go through that system,' Kaminsky said. Glibc, or the GNU C library, is used by most flavors of Linux and also a number of popular web services and frameworks, giving attacks potentially massive horizontal scale. The major Linux distros have patched and pushed updates to servers; source code is also available for homegrown Linux builds.

3 of 139 comments (clear)

  1. That's what they get by Anonymous Coward · · Score: 5, Funny

    For being glib about it. (ba dump)

  2. strlcpy() isn't good enough for glibc. by emil · · Score: 5, Interesting

    No, it "only leads to other errors".

    Funny, I haven't heard of any showstopper bugs in OpenBSD libc - not this year, not ever. And it's ubiquitous, since I'm running it on my phone.

    This bug, after ghost, would be a good opportunity to take a step back for a serious assessment of what must be removed for a secure system.

  3. Re:Hands up by chipschap · · Score: 5, Insightful

    If this would have been a vulnerability in MSVCRT, it would be concealed as long as possible, and who knows when it would be fixed?

    However as this is a Linux vulnerability, it was openly discussed and it was fixed at once.

    There, FTFY.