[owl-users] glibc bugs: not in Owl

Hi,

In case some of you are wondering why there's no glibc security update
for Owl when almost all major distros are releasing critical security
updates now, the answer is simple: Owl is not vulnerable to
CVE-2010-3847 and CVE-2010-3856 (both discovered by Tavis Ormandy).
This is for several reasons, including due to glibc source code
hardening we introduced many years ago (the "sanitize-env" patch).

For some context, here are Tavis' postings on the bugs:

http://lists.openwall.net/full-disclosure/2010/10/18/7
http://lists.openwall.net/full-disclosure/2010/10/22/15

Similarly not vulnerable are ALT Linux distributions, who have
forward-ported the "sanitize-env" changes to newer versions of glibc:

http://www.altlinux.com

I am not aware of other Linux distros reusing our glibc hardening code,
so any other distro with glibc 2.4+ should be presumed vulnerable...

Meanwhile, we've introduced security fixes to some PAM modules not used
on Owl by default, and we've updated many packages since the last ISO
snapshot (binutils, hdparm, ed, man-pages, diffstat, flex, ncurses, VIM,
and Linux-PAM):

http://www.openwall.com/Owl/CHANGES-current.shtml

...and there's now an RSS feed on that page (for the change log).

There's no new ISO snapshot yet, though.  When there is, it will
contain these updates and more (to be announced separately).

Alexander