2

https://googleonlinesecurity.blogspot.co.uk/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html

If I have an OpenWRT with default install, do I need to update, if we only count the threat from WAN/Internet side?

3

If it really is "default", then no update is required: OpenWRT has always used uClibc for its libc by default, it will not be vulnerable if so.

However, OpenWRT also supports glibc (and musl, which will be the default in the next release), so it is possible to have a vulnerable OpenWRT. Given the size and complexity of glibc, it's most likely that memory/storage constrained devices will not run a glibc version.

If you have a shell on the system, this should be useful: https://unix.stackexchange.com/questions/120380/what-c-library-version-does-my-system-use

If you built/configured it yourself, check CONFIG_LIBC in the .config in your build directory. Otherwise, check with the provider of the OpenWRT installation.

(It is also possible, though very unlikely, to have multiple libc instances. The OpenWRT build system does not support this though.)

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.