Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It will likely only open a calculator if you run it against the exact version of everything listed in the blog post, which is Ubuntu 12.04.5 without any further patches.

Any different version of Ubuntu (such as 14.04.anything), will have a different glibc binary. Among other issues, the exploit has a hard coded offset of the delta between the memset() and system() functions inside glibc. This offset will only be valid against the glibc binary for 12.04.5. With more work, the exploit could be modified to dynamically calculate the correct offset for almost any version of glibc.

If the offset is invalid, you're likely to still get a crash, just no calculator. So the presence of a crash or not can be used to determine trouble vs. ok.

That said, Ubuntu 14.04 isn't too badly affected. It does come with gstreamer-0.10, but it does not appear to be used for much. As far as I could tell, gstreamer-1.0 is used for the most important stuff (totem, totem-video-thumbnailer, etc.).



Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: