CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow • Hacker News Board

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#231

Post by hrjet » Wed, Jan 28, 2015, 8:08 AM UTC

Karellen wrote: post #229

lazaroclapp wrote: post #170

Earlier quoted context omitted.

Except, "just use another language! All problems of this huge category solved!" is true in this case. You can't have buffer overflows on a memory-safe language. Sure, this is only true assuming the VM and all the stuff it depends on is formally verified not to have buffer overflows either, which is unlikely to happen. But even so, you get the slightly weaker guarantee: "just use another language! All problems of this…

The things is, it's not necessarily true in this case. While C was intended to run as close to bare metal as possible, and 99% of current implementations do, that doesn't have to be the case. The C specification describes an abstract machine, and uses abstract concepts, with explicit "as-if" rules saying that implementations may, in many cases, do whatever they want, providing that conforming code runs as if it would…

You can't bounds check a pointer begotten from &arr[i]. It simply doesn't carry enough information. Moreover, there might be existing C programs that rely on out of bounds access (where they know that the out of bounds access falls into safe memory). So there is no way to implement a C virtual machine with bounds-checking semantics that is fully compatible with all existing C code.

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#232

Post by mirimir » Wed, Jan 28, 2015, 8:19 AM UTC

    Here is a list of potential targets that we investigated (they all call
    gethostbyname, one way or another), but to the best of our knowledge,
    the buffer overflow cannot be triggered in any of them:
    
    apache, cups, dovecot, gnupg, isc-dhcp, lighttpd, mariadb/mysql,
    nfs-utils, nginx, nodejs, openldap, openssh, postfix, proftpd,
    pure-ftpd, rsyslog, samba, sendmail, sysklogd, syslog-ng, tcp_wrappers,
    vsftpd, xinetd.

See "Re: Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow" " rel="nofollow">http://seclists.org/oss-sec/2015/q1/283>.

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#233

Post by SaveTheRbtz » Wed, Jan 28, 2015, 9:10 AM UTC

mirimir wrote: post #232

Here is a list of potential targets that we investigated (they all call gethostbyname, one way or another), but to the best of our knowledge, the buffer overflow cannot be triggered in any of them: apache, cups, dovecot, gnupg, isc-dhcp, lighttpd, mariadb/mysql, nfs-utils, nginx, nodejs, openldap, openssh, postfix, proftpd, pure-ftpd, rsyslog, samba, sendmail, sysklogd, syslog-ng, tcp_wrappers, vsftpd, xinetd. See "R…

nginx on most supporting platforms (`NGX_HAVE_GETADDRINFO && NGX_HAVE_INET6`) uses `getaddrinfo(3)`.

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#234

Post by tikums » Wed, Jan 28, 2015, 10:20 AM UTC

tedunangst wrote: post #57

driverdan wrote: post #50

If this was patched in 2013 why is it an issue now?

Because it was "silently" fixed so nobody applied the patch to existing, shipping systems.

Sweeping-under-rug is a common approach. It seems that in this instance, they have followed Linus Torvalds mantra, who once said: "I don't have any reason what-so-ever to think it's a good idea to track security bugs and announce them as something special. I don't think some spectacular security hole should be glorified or cared about as being any more special than a random spectacular crash due to bad locking."

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#235

Post by nilic » Wed, Jan 28, 2015, 10:22 AM UTC

McGlockenshire wrote: post #126

gtrubetskoy wrote: post #107

RedHat has a fix for 6 and 7 now: https://rhn.redhat.com/errata/RHSA-2015-0092.html

Does anyone have any insight into when we'll see CentOS packages start hitting the mirrors?

They are now available, on CentOS 6.4 yum update glibc installs glibc-2.12-1.149.el6_6.5

changelog: * Mon Jan 19 2015 Siddhesh Poyarekar - 2.12-1.149.5 - Fix parsing of numeric hosts in gethostbyname_r (CVE-2015-0235, #1183533).

Qualys GHOST program returns "not vulnerable" after the upgrade.

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#236

Post by elijahpaul » Wed, Jan 28, 2015, 1:01 PM UTC

voltagex_ wrote: post #183

DangerousPie wrote: post #77

Here is the test program, from http://www.openwall.com/lists/oss-security/2015/01/27/9 https://gist.github.com/koelling/ef9b2b9d0be6d6dbab63 To test your system, simply run this (but obviously only after making sure gistfile1.c is clean ;)) wget https://gist.githubusercontent.com/koelling/ef9b2b9d0be6d6dbab63/raw/de1730049198c64eaf8f8ab015a3c8b23b63fd34/gistfile1.c gcc gistfile1.c -o CVE-2015-0235 ./CVE-2015-0235

Anyone know how reliable that test is? I've got a system reporting not vulnerable but I'm not sure what glibc it has.

I've got a system reporting glibc 2.11, but the test reports 'not vulnerable'.

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#237

Post by growthape » Wed, Jan 28, 2015, 1:24 PM UTC

DangerousPie wrote: post #77

Here is the test program, from http://www.openwall.com/lists/oss-security/2015/01/27/9 https://gist.github.com/koelling/ef9b2b9d0be6d6dbab63 To test your system, simply run this (but obviously only after making sure gistfile1.c is clean ;)) wget https://gist.githubusercontent.com/koelling/ef9b2b9d0be6d6dbab63/raw/de1730049198c64eaf8f8ab015a3c8b23b63fd34/gistfile1.c gcc gistfile1.c -o CVE-2015-0235 ./CVE-2015-0235

We have already started to patch servers at Cloudways. Our CTO Pere Hospital explains how: http://www.cloudways.com/blog/ghost-vulnerability-patching/

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#238

Post by cellover » Wed, Jan 28, 2015, 1:24 PM UTC

windsurfer wrote: post #138

DangerousPie wrote: post #77

Here is the test program, from http://www.openwall.com/lists/oss-security/2015/01/27/9 https://gist.github.com/koelling/ef9b2b9d0be6d6dbab63 To test your system, simply run this (but obviously only after making sure gistfile1.c is clean ;)) wget https://gist.githubusercontent.com/koelling/ef9b2b9d0be6d6dbab63/raw/de1730049198c64eaf8f8ab015a3c8b23b63fd34/gistfile1.c gcc gistfile1.c -o CVE-2015-0235 ./CVE-2015-0235

I always laugh when people give you a URL to C code to test for remote code execution...

You know you can also read the source code right? Even if you are not proficient with c you can understand what it's doing.

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#239

Post by kyllo » Wed, Jan 28, 2015, 2:58 PM UTC

stormbrew wrote: post #218

kyllo wrote: post #214

Earlier quoted context omitted.

Nobody to be taken serious has ever thought or said this Linus Torvalds is nobody to be taken seriously?

I don't think Linus ever said it. I'm not sure he even agrees with it. Eric S. Raymond named it after him because of Linux. That said, Eric S. Raymond didn't say the quoted either. He said that "given enough eyeballs, all bugs are shallow", which is a much less bold claim (imo, at least) than that open source converges towards zero bugs over time.

Well it never meant "there are no bugs in open source code" over any length of time. It just means that if a project has enough eyeballs on it, bugs will be squashed quickly. But how many eyeballs is "enough"? Obviously OpenSSL didn't have enough. Does glibc?

Re: CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

#240

Post by ubiquitousthey » Wed, Jan 28, 2015, 3:31 PM UTC

yk wrote: post #78

So what I figured out so far: This is a quite nasty bug that may or may not affect everything that links against glibc (or eglibc). However the bug was fixed in glibc 2.18 and the advisory [1] includes a test program at the start of section 4. From this Ubuntu 10.04 LTS and 12.04 LTS are affected, but not 14.04 LTS. ( Can someone confirm this?) [1] http://www.openwall.com/lists/oss-security/2015/01/27/9

14.04 and 13.10 are not vulnerable