Giving names to bugs to make them sound scary

Summary: Even the company that bombarded the media with its "GHOST" nonsense admits that this bug, which was fixed two years ago, does not pose much of a threat

TWO days ago we wrote about the self-promotional FUD campaign from Qualys, noting that it had been blown out of proportion, as intended all along by Qualys (which even gave it the name "GHOST" and paid for expensive press releases in corporate news). A Red Hat employee reveals that even Qualys itself realised that its pet PR/marketing charade, "GHOST", is not much of a risk.

He said that "the people at Qualys that worked hard to hype GHOST into a doomsday bug had to admit that most software calling the gethostbyname function couldn't be forced to exploit the bug. As they say themselves (from "the Qualys Security Advisory team"):

"Here is a list of potential targets that we investigated (they all call gethostbyname, one way or another), but to the best of our knowledge, the buffer overflow cannot be triggered in any of them:

apache, cups, dovecot, gnupg, isc-dhcp, lighttpd, mariadb/mysql, nfs-utils, nginx, nodejs, openldap, openssh, postfix, proftpd, pure-ftpd, rsyslog, samba, sendmail, sysklogd, syslog-ng, tcp_wrappers, vsftpd, xinetd."

"To put things in perspective see this [discussion]," he added. It's LWN refuting Dan Goodin, the anti-GNU/Linux 'security' rhetoric person from Condé Nast (we took note of his coverage the other day).

"But as always," added the guy from Red Hat, "the truth isn't that clickbaiting...

"It was a bug. It has been fixed. But it wasn't that simple to exploit. Patches are available and as it seems no one got hurt." ⬆