Questions tagged [glibc]

The GNU C Library (glibc) is the GNU Project's implementation of the C standard library.

1
vote
0answers
347 views

Could not load library libcutils.so while injecting shellcode

I am working on my school thesis. I am trying to inject some shellcode into a shared library using Dirty Cow vulnerability on Android x86. My shellcode is written in asembly and only calls ...
9
votes
1answer
552 views

Jump Oriented Programming segmentation fault issue

I found this interesting post on jop, and since I was not familiar with the concept I decided to play with it. I managed to call arbitrary functions defined in my binary with or without arguments, but ...
4
votes
1answer
209 views

Return-to-libc Attack mystery

I'm studying the Return-to-libc Attack and I understand the concept. But one thing still does not make sense. In order to make the attack I need the memory address of system() and "/bin/sh", which is ...
1
vote
1answer
11k views

return to libc- finding libc's address and finding offsets

So I tried performing a return-to-libc according to https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-return-to-libc/ . I found libc's address by using "ldd vuln", and found system's ...
1
vote
1answer
69 views

How to increase gadget occurence in a program

I'm exercising with ROP. In a vulnerable program I control the RIP, use "ropeme" and search for gadgets I find many references to 32 bits long registers, but not a single extended register. I need a ...
5
votes
1answer
4k views

How to bypass ASLR with ROP

I was reading this article by the InfoSec institute: http://resources.infosecinstitute.com/an-introduction-to-returned-oriented-programming-linux/#gref And was able to follow along until he did the ...
1
vote
1answer
67 views

Where to get patches for recent CVEs announced for glibc?

My SoC vendor uses Yocto to create custom Embedded Linux distribution, that contains glibc 2.22. As part of the distribution we have received patches till CVE-2016-4429. But, now there are some ...
4
votes
2answers
2k views

Is ASLR useless in preventing attacks such as return-to-libc in linux?

If i'm correct, due ASLR we load libc into some random address. And then in order to make that happen without allowing write permissions of text pages within memory we use plt/got. Now I can simply ...
6
votes
2answers
4k views

Why must a ret2libc attack follow the order "system(),exit(),command?

In a ret2libc attack, I understand that the return address can be overwritten with the address of the system command, which takes a command string as an argument. In this case, shouldn't the address ...
6
votes
1answer
710 views

How to restrict dlopen() from or to certain paths?

If I want to disable execution of programs on a filesystem, I can use the noexec mount option. However, this doesn’t works with dynamic libraries loaded throughdlopen(). So what is the way to do it ...
3
votes
2answers
372 views

How to confirm that my router is vulnerable to the glibc vulnerability (CVE-2015-7547)?

I have tried PoC from Google (https://github.com/fjserna/CVE-2015-7547) to test my host PC (first execute the server side PoC then execute client side PoC). It was vulnerable. Now I want to check my ...
0
votes
1answer
46 views

CVE-2015-7547 vulnerability, if the glibc used is below 2.23 , but does not uses getaddrinfo

CVE-2015-7547 vulnerability, its mentioned,version of glibc below 2.23 are vulnerable. if the glibc used is below 2.23 , but application does not uses getaddrinfo() function, Is the application ...
9
votes
1answer
254 views

In light of the glibc DNS vulnerability, why aren't Linux distros updating install images?

Doesn't that make the mere act of updating a newly installed Linux instance unsafe, since the initially installed package manager is vulnerable? Am I missing something? For example, the current ...
2
votes
1answer
84 views

Does the glibc getaddrinfo vulnerability affect mobile applications?

Recently Google discovered the "glibc getaddrinfo" vulnerability (CVE-2015-7547) Is this a server side only issue, or can apps be affected by it as well? I'm developing both an iPhone and Android app,...
2
votes
2answers
373 views

Does the glibc getaddrinfo vulnerability affect Windows systems?

Recently Google discovered the "glibc getaddrinfo" vulnerability (CVE-2015-7547). Does this vulnerability affect Windows systems at all? I think it might because I'm not sure that glibc is a Linux-...
5
votes
1answer
1k views

strategy for dealing with glibc issues through all docker containers

CVE-2015-7547 affects glibc, which is present in pretty nearly all docker containers. There's an automated process underway which will update all official containers, but it's not immediately clear ...
0
votes
1answer
245 views

Plaintext DNS traffic in a WPA2 session?

The question I have is, in WPA2 session between the AP and client are DNS requests sent plain text? Trying to wrap my head around the latest glibc exploit. Thank you Ted
1
vote
0answers
66 views

How to react to the glibc vulnerability as an OSX user? [duplicate]

Apologies if this question isn't really fit for this SE site. Wasn't sure whether to post it here, or on apple.SE. What's the currently best way for a user of OSX to react to: https://...
0
votes
1answer
176 views

Can the latest glibc DNS vuln be tested on remote servers?

I recently heard of the critical DNS vulnerability in glibc that can lead to arbitrary code execution. I hadn't found much about the cases when the faulty function is called and ways to remotely ...
1
vote
2answers
2k views

glibc getaddrinfo (CVE-2015-7547) vulnerability: should I update glibc if I do not configure DNS?

Recently Googly discover glibc getaddrinfo (CVE-2015-7547) vulnerability: https://googleonlinesecurity.blogspot.co.il/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html We run our application on ...
3
votes
1answer
3k views

return-to-libc attack

I was trying to attempt at return-to-libc buffer overflow attack for my Computer Software Security assignment. As far as my understanding goes, we can do these kind of attacks regardless of stack ...
-1
votes
1answer
117 views

ROP: Use return value of function

Is it possible to call a function and store its return value in the next stack frame? So: call foo(); // int foo(); store return value of foo in next stack frame; call bar(int);
1
vote
2answers
159 views

Can an executable be scanned for calls to the vulnerable glibc ghost functions?

The ghost vulnerability has the potential to be vulnerable to many many pieces of software that call the gethostbyname() and gethostbyname2() functions. Is there an easy way to scan an executable to ...
10
votes
1answer
3k views

Is Java vulnerable to glibc GHOST Vulnerability in Linux?

I see on our RedHat Linux platform that "java" process has dependency over glibc library: [root@hpproliant1 ~]# ldd /usr/bin/java linux-gate.so.1 => (0xffffe000) libpthread.so.0 => /lib/...
10
votes
1answer
8k views

GHOST: which services are vulnerable, ssh, web server?

GHOST (CVE-2015-0235) just popped up. GHOST bug: is there a simple way to test if my system is secure? deals with how to find out if your system is vulnerable. exim is mentioned specifically. ...
61
votes
4answers
21k views

GHOST bug: is there a simple way to test if my system is secure?

GHOST (CVE-2015-0235) just popped up. How can I quickly check if a system of mine is secure? Ideally with a one line shell command. According to the ZDNet article "you should then reboot the system". ...