Hot answers tagged

71

It appears you can download a tool from the University of Chicago that will let you test your system for the vulnerability. This does not repair or restart anything it will only tell you if your system is vulnerable. $ wget https://webshare.uchicago.edu/orgs/ITServices/itsec/Downloads/GHOST.c $ gcc GHOST.c -o GHOST $ ./GHOST [responds vulnerable OR not ...


15

PHP one-liner: php -r '$e="0";for($i=0;$i<2500;$i++){$e="0$e";gethostbyname($e); }' Python one-liner: python -c 'import socket;y="0"*50000000;socket.gethostbyname(y)' If those give you segfaults (yes, a Python segfault, a rare specimen) then you're vulnerable. I don't know if you consider Python a "developer tool" but PHP is a common program to have. ...


14

One can reasonably conclude (see below) that it will require some detailed analysis to determine if an arbitrary software package is vulnerable, and what configuration or mitigations may apply. Any service which performs name resolution could be at risk (patch, and be safe!). Qualys have already provided a list of software using the affected functions which ...


9

aaronfay's answer already covered determining whether your underlying system is vulnerable, but it doesn't detect if there are programs that are still running using the old version of glibc after upgrade. That is, you could upgrade without restarting the affected processes, and the script would report "not vulnerable" even though the old, vulnerable library ...


7

The ret2libc (and return oriented programming (ROP)) technique relies on overwriting the stack to create a new stack frame that calls the system function. This wikipedia article explains stack frames in great detail: https://en.wikipedia.org/wiki/Call_stack#Stack_and_frame_pointers The stack frame dictates the order the function call and parameters are ...


7

Should I update glibc if I disable DNS service? Should I update glibc if I enable DNS service? The DNS service is about running your own DNS server. This bug is unrelated to this but is instead related to the DNS lookups done by the applications, i.e. your browser looking up the IP address of a site based on the hostname in the URL. Thus yes, you need ...


6

Possibly. The two functions that are vulnerable in glibc are gethostbyname and gethostbyname2. You noticed that java is linked to glibc, but to even be possible to be vulnerable it has to link to these specific functions. It's possible to scan the ELF binary and look through the linked libraries with the program readelf. It's recently come out that ...


5

This depends a little bit on the mitigations employed by the host. If you do not have ALSR on the target (rare on modern systems), and you know what OS they are running (e.g., Ubuntu 16.04), you can setup a system with the same versions and locate addresses that way. If you look at many Metasploit exploits, they have a table of TARGET versions that you can ...


5

Neither Android nor iPhone use glibc, so these are not affected. Android uses as libc Bionic and iOS is also using their own libc implementation.


4

This is an unfortunate consequence of relying on software built/maintained by others, over which you have no control. With Docker at least you have the opportunity of just replication the Dockerfile and then basing it on a fixed base image. My recommendation would be that you do exactly that. The base OS images should be fixed by now, if you're using one ...


4

Maintaining a distribution is Hard Work. It takes a lot of logistics to test the software packages,upgrade them, communicate with downstream developers, etc. The install disk is the first experience a user has with the software, and it simply has to work. If it doesn't, the user isn't installing the software. So that's why distributions only make point ...


4

Yes, if PIE is disabled. It is often said that ASLR's effectiveness is significantly reduced for applications which are not compiled with PIE (Position Independent Code) support. When PIE is not used, the program must rely on a fixed PLT, created during linking, to resolve the addresses of functions in shared libraries. When ASLR is used and PIE is enabled, ...


3

I agree it is very poorly explained in the article. It took me several reads to understand what on earth was going on. The key part is here: Our aim now is to build a chained ROP to execute execve(). As we can see, we don’t have a GOT entry for this function and libc is randomized. So what we will do first is to leak a libc function address for GOT ...


3

While you might not use the function in question, some other library function might use is somewhere, which potentially opens the vulnerability for exploit. It is therefor hard to know without actual (pen-) testing whether your application is vulnerable to this vulnerability.


2

If you are using a vulnerable version of glibc in windows, then yes. It is vulnerable. Of course glibc is not commonly used in the windows environment.


2

You can write a frame for any function call, it doesn't have to be system(). However most exploits will aim for a shell if possible. The fake_ret address is simply where the execution will return to after the system() call. If you just put \x41\x41\x41\x41 there it will segfault. If you point it at exit() it will gracefully exit, or you could point it at a ...


2

Start by compiling the vulnerable.c. Avoiding the creation of Position Independent Executable (PIE) simplifies things. $ uname -r 4.13.0-19-generic $ uname -m x86_64 $ gcc-6 --version gcc-6 (Ubuntu 6.4.0-8ubuntu1) 6.4.0 20171010 ... $ gcc-6 -no-pie vulnerable.c -o vulnerable -g -m32 -fno-stack-protector -O0 $ readelf -h vulnerable|grep Type Type: ...


2

return to plt and return to libc are slightly different attacks. Return to libc One of the ways to prevent buffer overflow is to use a non executable stack. To make non executable stack, from CPU & system level they use something called NX bit. If NX bit is set, that memory address is non executable. Even if we perform a buffer overflow and over write ...


2

Searching for CVE-2016-5417 points to nvd.nist.giv which has as resource listed a link to a patch. Note that these source patches are usually only for versions still supported by the authors of the software, i.e. often only the latest versions. And it might also be that the patch includes not only a fix for this specific issue but for multiple issues. In ...


2

First, before you can approach your problem, you need to check if the executable is running under ASLR (https://en.wikipedia.org/wiki/Address_space_layout_randomization) If that's the case, you will need to find a way to leak the address from the program, as the address of libc will be different every time. You can easily check this by running gdb-->b main-->...


1

I assume you are compiling your program in x86-64 mode, otherwise there would be no chance (nor need) for popping rdi. Generally speaking, smaller programs have fewer gadgets. Particularly very simple programs tend not to have many gadgets that begin in the middle of long instructions, as longer programs/libraries may have. Blocks compiled in if(0){} will ...


1

The reason exit() is included is to terminate the program gracefully. If you don't have exit() at the end of your chain the program will either continue to run weirdly or most likely terminate with a segmentation fault. It's not mandatory to include a call to exit(). Ideally you will construct your exploit in such a way that afterwards the program continues ...


1

Testing if the router is vulnerably requires the ability to run (and usually also compile) some proof of concept code at the router and watching the output. How this can be done is described in GHOST bug: is there a simple way to test if my system is secure?. But since there is usually no way to do this at most home routers (at least not for most users) you ...


1

Concern is largely unfounded as the glibc (GNU C library) https://en.wikipedia.org/wiki/GNU_C_Library is utilized on the *nix platforms and is not part of the native Windows environment. If you are running Cywin or any other Linux emulator, you might want to go ahead, patch and reboot


1

To find out if this calls are used, you could simply do a strings -a /bin/ip | grep gethost Another approach returning more information is readelf --dyn-syms /bin/ip | grep gethost


1

No, DNS requests are not sent in plaintext over the air between the access point and client device. All traffic between the two is encrypted according to the WPA2 spec using the supplied key, including DNS requests. Once the encrypted traffic containing the DNS request is received by the AP, it is decrypted and can be examined, and it is at that point that ...


1

Since the attack needs the client to first make a DNS request you need some way to trigger this request. If this can be done remotely depends on the server setup and applications running. But if you have access to the server you can try the PoC from google. Please not that failure of the PoC indicates only that the server is probably not affected but you ...


1

Why should not you upgrade? I usually evaluate the need to upgrade or not depending if it affects our infra-structure, however in this case, there are no doubts about it. Plus, it is rated as critical. Having 127.0.0.1 does not means that you do not have DNS, you could be pointing to a dnsmasq for instance. As others said, DNS is everywhere. Even without ...


Only top voted, non community-wiki answers of a minimum length are eligible