I'm talking about CVE-2015-0235.

I figured there's no Metasploit package for this kind of check yet and I also understood that there's a special VM by Qualys for this test.

Do you guys know of any other possibility of testing this vulnerability from outside the network?

Alternatively, can anyone tell me if there's any way to tell if this vulnerability is effective behind load balancer?

  • 2
    Note that load balancers are nothing more that computers, sometimes running Linux and may be vulnerable as well. – user42178 Jan 29 '15 at 14:23
  • The presence of load balancers is not a factor. – user1801810 Jan 29 '15 at 18:05
  • 1
    OK, I read some more about the case and apparently in order to exploit this vulnerability I have to make the server use the gethostbyname() function (or the 2 version of it) in order to resolve an address which is 1KB long and passes the regular sanity checks, meaning that if somehow I'll make any of the core apps to try and resolve a very long valid address it may lead to some arbitrary code launch, found the explanation here: chargen.matasano.com/chargen/2015/1/27/… – Yaron Feb 1 '15 at 15:19

The nature of the CVE-2015-0235 makes it impractical to scan remotely. The glibc library is used by many applications which may or may not be exploitable depending on what parts of glibc they use.

Your best bet is to identify which of your systems (they are your systems right?) are using the outdated version of glibc and patch accordingly. Consult with your distribution's maintainer to identify the packages and versions impacted. If you have many systems and don't already have a central patch management system in place, you may be able to write a script to help you identify what versions you're running where.

I don't see any reason that a system behind a load balancer couldn't be vulnerable. Again, it depends on the specific applications used and the setup, but in general, this vulnerability could still be exploited on a system behind a load balancer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.