Is Apache vulnerable to CVE-2015-1781?

Question

Is Apache vulnerable to CVE-2015-1781 (buffer overflow in the gethostbyname_r() family of functions)?

How can I quickly check if a system of mine is secure?

Answer 1

You must check the version of your glibc first: using this command can help:

ldd --version

The end of the answer has a good things you can skip and go there

According to this reference this vulnerability works on glibc version before 2.21-3. if your glibc is older than this version it is vulnerable.

The problem has been fixed upstream but a new version has yet to be released.

Also there is another vulnerability that Last revised is: 04/13/2015 and also is related to glibc version 2.20 and before it.

Also read this one: Red Hat alert RHSA-2015:0863-01 (glibc)

Arjun Shankar of Red Hat discovered that the nss_dns code does not adjust the buffer length when the buffer start pointer is aligned. As a result, a buffer overflow can occur in the implementation of functions such as gethostbyname_r, and crafted DNS responses might cause application crashes or result in arbitrary code execution. This can only happen if these functions are called with a misaligned buffer. I looked at quite a bit of source code, and tested applications with a patched glibc that logs misaligned buffers. I did not observe any such misaligned buffers.[Reference]

GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235)

This is another vulnerability related to glibc and gethostbyname() this artice said: "to the best of our knowledge, the buffer overflow cannot be triggered in any of [these]:

apache, cups, dovecot, gnupg, isc-dhcp, lighttpd, mariadb/mysql,

nfs-utils, nginx, nodejs, openldap, openssh, postfix, proftpd,

pure-ftpd, rsyslog, samba, sendmail, sysklogd, syslog-ng, tcp_wrappers,

vsftpd, xinetd."

So I think like this vulnerability your mentioned vulnerability does not affect on apache

and maybe this vulnerability has an effect on Apache or maybe not, but untill clarifying this issue. the fast countermeasure is upgrading glibc to last version.

Answer 2

Apache httpd source: 2.4.12

I did a Source code Grep for 'GLIBC' and 'gethostbyname'

• I found Refrences to the GlibC Libraries (so Apache could be using them)
• I also found the following uses of 'gethostbyname' :

  httpd-2.4.12/support/logresolve.pl.in:213: $hostname = gethostbyaddr(gethostbyname($ip), AF_INET);

  httpd-2.4.12/server/util.c:45:#include [netdb.h] /* for gethostbyname() */

  httpd-2.4.12/os/os2/core_header.def:13: "gethostbyname"

  httpd-2.4.12/docs/manual/developer/thread_safety.html.en:175: [code]gethostbyname()[/code] which are not thread-safe on most C

  httpd-2.4.12/docs/manual/developer/thread_safety.html.en:178: [code]gethostbyname()[/code] are thread-safe on your OS, c-client

  httpd-2.4.12/docs/manual/misc/perf-tuning.html.en:147: could consider doing the [code]gethostbyname[/code] call in the

  httpd-2.4.12/docs/manual/misc/perf-tuning.html.fr:161: certains CGIs, vous pouvez effectuer l'appel � [code]gethostbyname[/code]

  httpd-2.4.12/docs/manual/misc/perf-tuning.html.tr.utf8:152: bu ihtiyaçlarına yönelik olarak [code]gethostbyname[/code] çağrıları

  httpd-2.4.12/docs/manual/misc/perf-tuning.html.ko.euc-kr:139: CGI [code]gethostbyname[/code]

  httpd-2.4.12/test/test_limits.c:123: if ((he = gethostbyname(addr)) == NULL) {

  httpd-2.4.12/test/test_limits.c:124: perror("gethostbyname");

  httpd-2.4.12/modules/arch/netware/mod_nw_ssl.c:196: hep = gethostbyname(w);

  httpd-2.4.12/modules/metadata/mod_unique_id.c:64: * gethostbyname (gethostname()) is unique across all the machines at the

So apache httpd could be vulnerable, it further depands on what version of glibc is beeing used. the one reported at risk is Any version below glibc 2.12 (glib 6)

Answer 3

Apache is using Apache Portability Runtime and they implemented their own apr_gethostbyname, so the core server is not vulnerable.

But over the time, some modules, apparently they didn't use APR gethostbyname function, so is very plausible to still find some modules using it.

Also the apache is correctly validating all the inputs, so is a very low chance to hit the overflow even the Apache is using this function.

I made a quick check and I didn't find any reference to gethostbyname_r, so 99.999% Apache Web Server is not vulnerable.

Update:

Also you can see my colleagues are already looking in the source code and gethostbyname was spoted in just 2 modules.