Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

openwall.com

Post reply on HN
Print view View original

131–140 of 254 posts

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#131

Post by mootothemax »

discordianfish wrote: post #116

In case anyone has tons of Docker images and looks for a easy way to list those which include a vulnerable glibc version, here is a handy one-liner: https://5pi.de/2015/01/27/find-ghosts-in-your-docker-images/

FYI I get a certificate error - ERR_CERT_AUTHORITY_INVALID - when trying to access your site over the provided https link. OS X 10.10, Chrome and Safari.

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#132

Post by zrm »

tptacek wrote: post #112
zrm wrote: post #83

Earlier quoted context omitted.

gethostbyname() and friends fill in struct hostent: struct hostent { char *h_name; /* official name of host */ char **h_aliases; /* alias list */ int h_addrtype; /* host address type */ int h_length; /* length of address */ char **h_addr_list; /* list of addresses */ } The pointers in the structure point into the buffer. There could be any number of host aliases or IP addresses.

That's true and a good point, but not (it seems) applicable to this particular function, which validates whether or not the name is one of two fixed-sized formats, right? (edit) You may be totally right here, by the way.

It looks like what's going on is that gethostbyname() calls __nss_hostname_digits_dots() which checks to see if the string you passed it was an IPv4 or IPv6 address rather than a name, and in that case it functions like inet_aton/inet_pton and converts the IP address string to a binary IP address as though the "name" 1.2.3.4 resolved to IP address 1.2.3.4.

In that specific case there are no aliases and exactly one IP address, but the buffer could still be too small (e.g. if caller-supplied with gethostbyname_r()).

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#134

Post by AgentME »

peterwwillis wrote: post #72
rdtsc wrote: post #55

Earlier quoted context omitted.

It is nice if they can count. However instead of sending them back to kindergarten, it might make sense to find a compiler/language/framework that would make inability to count not result in easy remote exploits.

So remove the ability to use pointers to directly access memory. Then you're only left with all of the other security vulnerabilities found in every such language.

Uh, how often do code execution vulnerabilities show up in non-C programs compared to how often they show up in C programs?

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#135

Post by api »

Karunamon wrote: post #5

Details on this one appear to be quite sparse - under what use cases would a remote user be able to craft invalid IP addresses?

I'm guessing vulnerable cases will be where string-encoded IP addresses are accepted from the network and passed directly to these functions, such as by web apps or things that take string-serialized encodings. This would allow an attacker to pass any string in as an IP address.

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#137

Post by darkr »

McGlockenshire wrote: post #126
gtrubetskoy wrote: post #107

RedHat has a fix for 6 and 7 now: https://rhn.redhat.com/errata/RHSA-2015-0092.html

Does anyone have any insight into when we'll see CentOS packages start hitting the mirrors?

Apparently packages are built but currently awaiting signing + release. Hopefully within an hour or two they should hit the mirrors.

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#138

Post by windsurfer »

DangerousPie wrote: post #77

Here is the test program, from http://www.openwall.com/lists/oss-security/2015/01/27/9 https://gist.github.com/koelling/ef9b2b9d0be6d6dbab63 To test your system, simply run this (but obviously only after making sure gistfile1.c is clean ;)) wget https://gist.githubusercontent.com/koelling/ef9b2b9d0be6d6dbab63/raw/de1730049198c64eaf8f8ab015a3c8b23b63fd34/gistfile1.c gcc gistfile1.c -o CVE-2015-0235 ./CVE-2015-0235

I always laugh when people give you a URL to C code to test for remote code execution...
Post reply on HN