The guys at Qualys discovered a very interesting buffer overflow in the __nss_hostname_digits_dots() function of glibc. The main problem is that you can take advantage of this remotely via the gethostbyname*() functions, which are used in many applications. They dubbed this “GHOST” (due to the GetHOST… name). The CVE assigned to this is: CVE-2015-0235.
Currently, all distributions of Linux are vulnerable.
This was apparently fixed between glibc-2.17 and glibc-2.18, but it was ignored in the long term “stable” releases.
Here is some code to check if you are vulnerable:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 |
/* * Qualys test program to check for presence of GHOST vulnerability * For more info: http://www.openwall.com/lists/oss-security/2015/01/27/9 * Save this in "CVS-2015-0235.c" and compile "gcc CVS-2015-0235.c -o CVS-2015-0235" * Execute: "chmod 755 CVS-2015-0235 && ./CVS-2015-0235.c" */ #include <netdb.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <errno.h> #define CANARY "in_the_coal_mine" struct { char buffer[1024]; char canary[sizeof(CANARY)]; } temp = { "buffer", CANARY }; int main(void) { struct hostent resbuf; struct hostent *result; int herrno; int retval; /*** strlen (name) = size_needed - sizeof (*host_addr) - sizeof (*h_addr_ptrs) - 1; ***/ size_t len = sizeof(temp.buffer) - 16*sizeof(unsigned char) - 2*sizeof(char *) - 1; char name[sizeof(temp.buffer)]; memset(name, '0', len); name[len] = '\0'; retval = gethostbyname_r(name, &resbuf, temp.buffer, sizeof(temp.buffer), &result, &herrno); if (strcmp(temp.canary, CANARY) != 0) { puts("vulnerable"); exit(EXIT_SUCCESS); } if (retval == ERANGE) { puts("not vulnerable"); exit(EXIT_SUCCESS); } puts("should not happen"); exit(EXIT_FAILURE); } |
Here is a way to find every service using libc:
|
1 2 3 |
lsof | grep libc | awk '{print $1}' | sort | uniq |
If you are vulnerable, updates have already been pushed out by the vendors.
For Ubuntu/Debian, you can: apt-get update && sudo apt-get install –only-upgrade libc6 -y
For Centos/RHEL, you can: “yum update glibc”
A great summary of the key things can be found here:
https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability
A very good technical writeup of the details can be found here:
http://www.openwall.com/lists/oss-security/2015/01/27/9
A few of the major linux distribution advisories:
RedHat: https://rhn.redhat.com/errata/RHSA-2015-0090.html
Ubuntu: https://launchpad.net/ubuntu/+source/eglibc
Debian: https://security-tracker.debian.org/tracker/CVE-2015-0235
Post Navigation