Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

openwall.com

Post reply on HN
Print view View original

201–210 of 254 posts

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#201

Post by cozzyd »

frabcus wrote: post #142

This might be a good time to sign the promise not to use C/C++ on new projects... http://www.flourish.org/promise/

yeah by using python, you will never run into problems like this https://github.com/python/cpython/search?utf8=✓&q=gethostbyn...

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#202

Post by jerematasno »

peterwwillis wrote: post #27
WestCoastJustin wrote: post #14

When the patches are available, you need to update, and likely reboot. Mattias Geniar talks about using the following command to find processes depending on libc, any of which could be running the vulnerable code, these are core processes that you probably cannot just cycle without a reboot [1]. For me the listing looks something like this: agetty, auditd, dbus-daem, dhclient, init, master, mysqld, rsyslogd, sshd, ud…

They're only attacking host-lookup, so you just have to worry about people who can connect to your service and are able to control name server response. This means your network services that are internet-accessible. Everything else can wait for a maintenance window for the reboot. ~# netstat -lnp | grep -e "\(tcp.*LISTEN\|udp\)" | cut -d / -f 2- | sort -u cupsd dnsmasq httpd nmbd ntpd qemu-kvm rpc.portmap rpc.statd s…

It doesn't have to be internet accessible, AFAIK. If an attacker can get something to do arbitrary DNS lookups, I think it can be attacked. For instance, monitoring/log correlation software might be vulnerable.

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#203

Post by rdhyee »

As a non-professional in the area of Linux security, let me share what I figured out while patching Ubuntu 12.04 servers for GHOST. In my situation at least, I got confused by looking for glibc and eglibc, which are listed as packages to be patched in http://people.canonical.com/~ubuntu-security/cve/2015/CVE-20....

I wanted to know what version of glibc and eglibc my servers were running so that I could check that they were getting updated. Running

   dpkg -s glibc
and

   dpkg -s eglibc
turned up nothing. How could that be since there had to be a C library?!

Answer: there are indeed compiled C libraries on my servers. I found that the key packages to update were related to libc6 (http://packages.ubuntu.com/precise/libc6), which were compiled from eglibc.

At any rate, I patched my servers with a typical procedure:

    sudo apt-get update 
    sudo unattended-upgrades
BTW, it helped me to understand that Ubuntu 12.04 uses eglibc and not glibc: http://askubuntu.com/questions/372864/why-ubuntu-uses-eglibc... to make sense of the charts at http://people.canonical.com/~ubuntu-security/cve/2015/CVE-20..., especially the reason for the "DNE" (does not exist?) for Ubuntu 12.04 and glibc.

Hope this is clarifying to someone out there. Would love to hear confirmation or refutation of my reasoning here.

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#206

Post by yrro »

rdhyee wrote: post #203

As a non-professional in the area of Linux security, let me share what I figured out while patching Ubuntu 12.04 servers for GHOST. In my situation at least, I got confused by looking for glibc and eglibc, which are listed as packages to be patched in http://people.canonical.com/~ubuntu-security/cve/2015/CVE-20... . I wanted to know what version of glibc and eglibc my servers were running so that I could check that t…

FYI, if you want to identify which package shipped a particular file:

    $ dpkg -S /lib/x86_64-linux-gnu/libc.so.6 
    libc6:amd64: /lib/x86_64-linux-gnu/libc.so.6
Hence 'libc6' is the package as you figured out.

If you want to see the status of a particular vulnerability in Debian, you can use the Security Tracker: https://security-tracker.debian.org/tracker/CVE-2015-0235 which links to the security advisory and tells you that the bug was fixed in version 2.13-38+deb7u7 of the package.

Note that any programs running before you upgraded the library will need to be restarted in order to use the fixed version. There's a program called checkrestart that will tell you which programs need to be restarted, or you can play it safe and reboot your system after applying library updates.

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#207

Post by jerematasno »

eslaught wrote: post #82
0x0 wrote: post #46

Earlier quoted context omitted.

yes

What versions are affected? E.g. Ubuntu 14.04 appears to be on 2.19-0ubuntu6.5 (just updated). Does that include the fix?

Full blog post coming, but 14.04 was never vulnerable. glibc 2.17 was the last vulnerable version.

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#208

Post by rdhyee »

yrro wrote: post #206
rdhyee wrote: post #203

As a non-professional in the area of Linux security, let me share what I figured out while patching Ubuntu 12.04 servers for GHOST. In my situation at least, I got confused by looking for glibc and eglibc, which are listed as packages to be patched in http://people.canonical.com/~ubuntu-security/cve/2015/CVE-20... . I wanted to know what version of glibc and eglibc my servers were running so that I could check that t…

FYI, if you want to identify which package shipped a particular file: $ dpkg -S /lib/x86_64-linux-gnu/libc.so.6 libc6:amd64: /lib/x86_64-linux-gnu/libc.so.6 Hence 'libc6' is the package as you figured out. If you want to see the status of a particular vulnerability in Debian, you can use the Security Tracker: https://security-tracker.debian.org/tracker/CVE-2015-0235 which links to the security advisory and tells you…

thanks especially for the tip about restarting the system, just in case.

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#209

Post by beagle3 »

contingencies wrote: post #18
WestCoastJustin wrote: post #14

When the patches are available, you need to update, and likely reboot. Mattias Geniar talks about using the following command to find processes depending on libc, any of which could be running the vulnerable code, these are core processes that you probably cannot just cycle without a reboot [1]. For me the listing looks something like this: agetty, auditd, dbus-daem, dhclient, init, master, mysqld, rsyslogd, sshd, ud…

For immediate actions, maybe also set 'UseDNS no' in /etc/ssh/sshd_config and restart any public-facing ssh servers.

This is a good idea in general. However, every version of ssh that I could test (going back to Ubuntu 8.04) uses getaddrinfo() rather than gethostbyname() and is therefore safe.

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#210

Post by beagle3 »

As far as I can tell, sshd has always used getaddrinfo() which is not vulnerable (rather than gethostbyname() which is). Can anyone confirm?

According to this comment: https://news.ycombinator.com/item?id=8954458 , getaddrinfo() uses gethostbyname() internally. So, is a default 'UseDNS yes' ssh setup vulnerable or not?

Post reply on HN