3

I have tried PoC from Google (https://github.com/fjserna/CVE-2015-7547) to test my host PC (first execute the server side PoC then execute client side PoC). It was vulnerable.

Now I want to check my router, but I'm not sure how to test it. Iif I modify /etc/resolv.conf to nameserver [my router's ip], then just execute client side PoC, it shows:

CVE-2015-7547-client: getaddrinfo: Name or service not known

Does it mean my router is not vulnerable?

1

Testing if the router is vulnerably requires the ability to run (and usually also compile) some proof of concept code at the router and watching the output. How this can be done is described in GHOST bug: is there a simple way to test if my system is secure?.

But since there is usually no way to do this at most home routers (at least not for most users) you will probably not be able to test the router yourself. Instead you need to check with the vendor for more information like a statement that the router is not vulnerable or an updated firmware.

-1

You can test for yourself using CloudFlare's updated PoC code, available as linked gists throughout the below post.

https://blog.cloudflare.com/a-tale-of-a-dns-exploit-cve-2015-7547/

This does require somewhat of an understanding of valgrind output, but you can also use any other fault monitor, debugger, or other technique to watch your registers -- especially eip/rip

  • How does this help in finding out if the router itself is vulnerable? Given that one usually has no shell on the router one cannot execute the PoC there. – Steffen Ullrich Mar 2 '16 at 17:15
  • If it stops working... – atdre Mar 2 '16 at 21:17
  • 1
    I think you are suggesting to use the router as resolver from the client and then run the PoC. But the DNS server at the router will usually simply forward packets from outside and not use the vulnerable getaddrinfo at all. getaddrinfo might instead be used in other places inside the router, like to get updates. This means you will not know if the router is vulnerable just by using it as a resolver. – Steffen Ullrich Mar 3 '16 at 5:05
  • Ok. Update the router then and if it doesn't work, it's vulnerable – atdre Mar 3 '16 at 5:32
  • What you are effectively suggesting is to find out where getaddrinfo is used inside the router and then try to trigger these parts from outside the router. Which is kind of impossible unless you have the source code (or reverse engineer it) for the the exact firmware version your router is running. This would be out of reach for most users to do. – Steffen Ullrich Mar 3 '16 at 6:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.