251–254 of 254 posts
Earlier quoted context omitted.
We have already started to patch servers at Cloudways. Our CTO Pere Hospital explains how: http://www.cloudways.com/blog/ghost-vulnerability-patching/
All due respect, I think "explains that" would be more accurate than "explains how" here
for s in $(lsof | grep libc | awk '{print $1}' | sort | uniq); do if [[ -f "/etc/init.d/$s" && "$(ps aufx | grep -v grep | grep $s)" ]]; then echo $s; service $s restart; fi; done
From: http://blog.wallarm.com/post/109402223343/ghost-a-brief-reca...
--Conclusion: inet_aton() is the only option, and the hostname must have one of the following forms: "a.b.c.d", "a.b.c", "a.b", or "a", where a, b, c, d must be unsigned integers, at most 0xfffffffful, converted successfully (ie, no integer overflow) by strtoul() in decimal or octal (but not hexadecimal, because 'x' and 'X' are forbidden). --
So essentially, any DNS lookups of the form a.b.c.d, a.b.c, a.b, or a where a,b,c,d are all numbers, should be considered suspicious?
Earlier quoted context omitted.
It doesn't have to be internet accessible, AFAIK. If an attacker can get something to do arbitrary DNS lookups, I think it can be attacked. For instance, monitoring/log correlation software might be vulnerable.
If you have backend systems parsing XML, then an XXE[1] attack could trigger a DNS lookup, for example. [1] https://www.owasp.org/index.php/XML_External_Entity_%28XXE%2...