2

I'm talking about CVE-2015-0235.

I figured there's no Metasploit package for this kind of check yet and I also understood that there's a special VM by Qualys for this test.

Do you guys know of any other possibility of testing this vulnerability from outside the network?

Alternatively, can anyone tell me if there's any way to tell if this vulnerability is effective behind load balancer?

3
  • 2
    Note that load balancers are nothing more that computers, sometimes running Linux and may be vulnerable as well.
    – user42178
    Commented Jan 29, 2015 at 14:23
  • The presence of load balancers is not a factor. Commented Jan 29, 2015 at 18:05
  • 1
    OK, I read some more about the case and apparently in order to exploit this vulnerability I have to make the server use the gethostbyname() function (or the 2 version of it) in order to resolve an address which is 1KB long and passes the regular sanity checks, meaning that if somehow I'll make any of the core apps to try and resolve a very long valid address it may lead to some arbitrary code launch, found the explanation here: chargen.matasano.com/chargen/2015/1/27/…
    – Yaron
    Commented Feb 1, 2015 at 15:19

1 Answer 1

4

The nature of the CVE-2015-0235 makes it impractical to scan remotely. The glibc library is used by many applications which may or may not be exploitable depending on what parts of glibc they use.

Your best bet is to identify which of your systems (they are your systems right?) are using the outdated version of glibc and patch accordingly. Consult with your distribution's maintainer to identify the packages and versions impacted. If you have many systems and don't already have a central patch management system in place, you may be able to write a script to help you identify what versions you're running where.

I don't see any reason that a system behind a load balancer couldn't be vulnerable. Again, it depends on the specific applications used and the setup, but in general, this vulnerability could still be exploited on a system behind a load balancer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .