3

Apparently there is a bug in the GNU C Library, that can cause a buffer overflow, how can I protect myself from it?!

Reference:

  • possible duplicate of CVE-2015-0235 How to update eglibc to 2.15-0ubuntu10.10 – muru Jan 27 '15 at 21:10
  • Not a dupe. I am asking What is ... and ...how can i protect... he's is ...how to update.... Therefore IMO, not a dupe. – blade19899 Jan 27 '15 at 22:00
  • OK. I posted an answer since you hadn't yet. Comment when you do, so I can remove it once your more-thorough post comes up. – muru Jan 27 '15 at 22:58
  • @muru, not this time. Last week and a half of Internship, don't have time for that right now. But, your answer seems to be good enough! I'll wait to see what the community thinks, and then I will accept it. Remind me if I forget! :) – blade19899 Jan 28 '15 at 9:20
  • FWIW there's very limited value in having more than one question about a single vulnerability. A good question and answer should cover all of those (what, why, how to fix, etc) automatically. – Oli Feb 18 '16 at 8:34
5

According to the Ubuntu Security Notices, this affects 10.04 and 12.04 among the currently supported versions of Ubuntu.

How can I protect myself?

Upgrade.

sudo apt-get update
sudo apt-get upgrade

Or, specifically:

sudo apt-get update
sudo apt-get install libc6

Check the currently installed version using apt-cache policy libc6:

  • For 12.04, it should be 2.15-0ubuntu10.10, or higher.
  • For 10.04, it should be 2.11.1-0ubuntu7.20, or higher.

Restart.

libc is a core package. You should restart to be sure nothing on your system is using the old version.

At the least, restart every service running on your system.

What is it?

The team who discovered this vulnerability has published an advisory (posted in the mailing list referred), examining the code involved and case studies. It includes a C program to detect if the system is vulnerable.

Essentially, look-ups of IPv4-style addresses (those involving numbers and dots) can cause this trigger.

[The] hostname must have one of the following forms: "a.b.c.d", "a.b.c", "a.b", or "a", where a, b, c, d must be unsigned integers, at most 0xfffffffful, converted successfully (ie, no integer overflow) by strtoul() in decimal or octal (but not hexadecimal, because 'x' and 'X' are forbidden).

This is due to a miscalculation in the size of a buffer needed, where the size is a bit short, allowing a strcpy down the line to write past the end of the buffer by a limited amount (4 bytes on 32-bit machines, or 8 bytes on 64-bit machines).

An exploit has been written by the team against the Exim mail server, but the code has not been released yet.

The list of services affected include, but is not limited to:

MySQL servers, Secure Shell servers, form submission apps, and other types of mail servers. ... Apache, Cups, Dovecot, GnuPG, isc-dhcp, lighttpd, mariadb/mysql, nfs-utils, nginx, nodejs, openldap, openssh, postfix, proftpd, pure-ftpd, rsyslog, samba, sendmail, sysklogd, syslog-ng, tcp_wrappers, vsftpd, and xinetd.


Apparently the test code is available on the University of Chicago website. Therefore you can do:

wget https://webshare.uchicago.edu/orgs/ITServices/itsec/Downloads/GHOST.c
gcc GHOST.c -o GHOST
./GHOST

The final output would be vulnerable or not vulnerable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.