Extremely severe bug leaves dizzying number of software and devices vulnerable

[CiscoX]

Are we safe?

http://arstechnica.com/security/201...zzying-number-of-apps-and-devices-vulnerable/

https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html

 

[ColinTaylor]

Only effects glibc (>= 2.9) which Asus don't use AFAIK. I think Asus use uClibc.

 

[RMerlin]

glibc is rarely used in routers and other embedded devices, because it has a pretty high memory footprint. Most of these use uclibc and musl instead.

 

[sfx2000]

Still worthwhile to check backend services if one is port-forwarding hosts (or VPN connections).

Patches are already out for most major linux distributions - which will be a bit disruptive for some, as it's a reboot event - concern here is the same as what we saw with the old Ghost glibc bug for apps that static link (e.g. built in, rather than using the system level c library.)

 

[evh909]

Still worthwhile to check backend services if one is port-forwarding hosts (or VPN connections).

Patches are already out for most major linux distributions - which will be a bit disruptive for some, as it's a reboot event - concern here is the same as what we saw with the old Ghost glibc bug for apps that static link (e.g. built in, rather than using the system level c library.)

for those looking for instructions/tips on how to check/update your servers, see the link below:
http://www.cyberciti.biz/faq/linux-...libc-getaddrinfo-stack-based-buffer-overflow/
That is a nice linux site with a newsletter if you want to subscribe (once a week or so). I would agree that most actual devices (ie, not servers/pcs/virtual machines) are using the smaller custom versions of glibc so shouldnt be a concern for most "devices". if you read the ars article (big fan of that site too), smartphones (android or apple) also use smaller or custom versions of the library and are not affected.

 

[sfx2000]

It's localized to glibc for now... uClibc/Bionic/libc/musl - they're all good - for now - but one knows that folks will start banging on the alt libs just the same for their 10 seconds of fame...

the bug has actually been implemented for a long time - not much different than the GHOST bug from some time back...

Most small footprint distros - not much impact, again, because the system level C-Lib isn't glibc - it's the closed source binaries that might statically link them... and for systems that did implement the GNU C Library, well, the fix is a bit painful, as it can be not just one package, but up to 6 at last count - and a reboot to clear out the old packages - ShellShock and Heartbleed were easier to deal with...

 

[kvic]

EdgeOS seems affected. ER-Lite and ER-X users might want to watch out. ubnt is speedy in response though. Patches already available. More details here.

I wonder if Entware-ng is affected as it's using glibc for anything but mips..

 

[ASAT]

Just to be safe, I applied the patch to my Entware-ng toolchain and recompiled all the packages.

[PATCH] CVE-2015-7547 --- glibc getaddrinfo() stack-based buffer overflow


-