Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

openwall.com

Post reply on HN
Print view View original

31–40 of 254 posts

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#32

Post by tedunangst »

tptacek wrote: post #24
unwind wrote: post #8

Earlier quoted context omitted.

Obligatory git link for the curious: https://sourceware.org/git/?p=glibc.git;a=blob;f=nss/digits_... . Note that this is a HEAD link, so if there are changes after I post this they should appear. I don't claim to have spotted the suspicious code (it's not ... super-accessible), just wanted to provide a link to the file in question.

I'm not fully though my morning bootup process and so not really ready to grok this but, can anyone give a quick summary of why gethostbyname() needs to hit the heap at all, let alone with a realloc call? There's a maximum hostname length, and it's not huge. Also: isn't this function just saying "yes" or "no" to a candidate hostname? Can't it just say "no" if the hostname is super long?

From the GNU coding standards:

> Avoid arbitrary limits on the length or number of any data structure, including file names, lines, files, and symbols, by allocating all data structures dynamically.

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#33

Post by rkwasny »

This looks like an "accident" by PR Agency:

http://www.frsag.org/pipermail/frsag/2015-January/005722.htm... From: Mar 27 Jan 15:28:45 CET 2015

Half an hour after Redhat lifted embargo from the ticket: https://bugzilla.redhat.com/show_activity.cgi?id=1183461 2015-01-27 10:03:14 EST Removed: EMBARGOED CVE-2015-0235

If this is true this lady gets an award for best security disclosure this year ;-)

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#34

Post by martius »

ryan-c wrote: post #31

Reading the thread, it does appear that someone broke embargo on this. http://www.frsag.org/pipermail/frsag/2015-January/005727.htm... http://www.frsag.org/pipermail/frsag/2015-January/005726.htm...

Yes, the mail you link says:

"I will keep you posted in next hours. I send the notice to early. Big fail of my own. Stay tuned."

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#35

Post by amlweems »

Qualys Security Advisory: http://www.openwall.com/lists/oss-security/2015/01/27/9

Lots of info about their discovery. Apparently they developed a PoC exploit. They've also included a pretty short test program to determine if a system is vulnerable or not.

Here's a gist of the test (copied from their advisory): https://gist.github.com/amlweems/6e78d03810548b4867d6

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#37

Post by yeukhon »

Is Ubuntu 12.04 vulnerable to this?

>> this vulnerability affects many systems from Linux glibc-2.2 version published on 10 November 2000.

>> a fixed was pushed to glibc-2.17 et glibc-2.18

Ran dpkg -l libc6 on 12.04.5 shows it's 2.15. So anything before 2.17?

/lib/x86_64-linux-gnu/libc.so.6 GNU C Library (Ubuntu EGLIBC 2.15-0ubuntu10.7) stable release version 2.15, by Roland McGrath et al.

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#38

Post by jameskilton »

0x0 wrote: post #36

Here is the full Qualys report with an in-depth analysis: http://www.openwall.com/lists/oss-security/2015/01/27/9 Also contains a writeup about a remote Exim exploit (which is the default mail server on at least Debian).

From this, the vulnerability was fixed in May 2013 so any systems from there or later (e.g. Ubuntu 14.04) are fine. Older systems obviously now need to wait for the patches to come through.

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#39

Post by href »

yeukhon wrote: post #37

Is Ubuntu 12.04 vulnerable to this? >> this vulnerability affects many systems from Linux glibc-2.2 version published on 10 November 2000. >> a fixed was pushed to glibc-2.17 et glibc-2.18 Ran dpkg -l libc6 on 12.04.5 shows it's 2.15. So anything before 2.17? /lib/x86_64-linux-gnu/libc.so.6 GNU C Library (Ubuntu EGLIBC 2.15-0ubuntu10.7) stable release version 2.15, by Roland McGrath et al.

According to Canonical it is: http://www.ubuntu.com/usn/usn-2485-1/

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#40

Post by zwp »

ryan-c wrote: post #13
antocv wrote: post #11

Is this serious? Does this mean if I have an app, Java, PHP or whatever, which eventually calls glibc's gethostbyname gethostbyaddr, my machine is owned? That somebody could just craft a special hostname or ip address to lookup? So all those websites where you enter hostname o IP address to lookup something like whois info or ping other machines, could be owned?

If it affects gethostbyaddr that'd be really bad - there are a lot of applications that automatically look up reverse DNS on a connection. Mail servers in particular generally make it pretty easy to trigger both forward and reverse lookups. The test case seems to have it looking up an ip address as if it were a name, but it's using the reentrant version of the function - maybe only those are affected?

> If it affects gethostbyaddr

The release at http://www.frsag.org/pipermail/frsag/2015-January/005722.htm... says that it affects both gethostbyname() and gethostbyaddr().

Post reply on HN