CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by 4ad on Tuesday January 27, 2015 @11:37AM (#8954011)

A note about Go. Go has its own DNS resolver, but unfortunately, if you compile natively, it's not enabled by default. It's only enabled if you cross-compile, or if you disable cgo, or if you rebuild the standard library with -tags netgo.

/edit: a second note about Go; even without the native resolver, Go uses getaddrinfo, not gethostbyname*, and it's not vulnerable.

[ Parent | on HN ]

Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by 0x0 on Tuesday January 27, 2015 @12:31PM (#8954393)

So.... an application acts differently if it is cross-compiled? And if there's a vuln in the go resolver, binaries are "maybe" vulnerable, depending on whether they were cross-compiled or not?

[ Parent | on HN ]

Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by 4ad on Tuesday January 27, 2015 @12:36PM (#8954426)

I'm not sure why you were downvoted. In an ideal world, the behavior of the native Go resolver and the host resolver should be the same, but in the real world they might behave differently and might have different bugs. The nice thing about the native Go resolver is that it's written in a memory safe language which prohibits bugs like these.

[ Parent | on HN ]