mercredi 28 janvier 2015

Complete Guide to Ghost Vulnerability - CVE-2015-0235


I would like to create a complete guide to the Ghost Vulnerability. Here is all the information I have gathered so far from multiple sources (credits to those sources).


My only question I have so far is: Does this Vulnerability require access (as in being a logged in user) to the effected OS in question? Can someone clarify the 'remote attacker that is able to make an application call' part with an example?


Please edit/comment/add to this post and thread with whatever information you have so other people who are also curious can be informed.


Now for what I have gathered:




Background Information


GHOST is a 'buffer overflow' bug affecting the gethostbyname() and gethostbyname2() function calls in the glibc library. This vulnerability allows a remote attacker that is able to make an application call to either of these functions to execute arbitrary code with the permissions of the user running the application.


Impact


The gethostbyname() function calls are used for DNS resolving, which is a very common event. To exploit this vulnerability, an attacker must trigger a buffer overflow by supplying an invalid hostname argument to an application that performs a DNS resolution.


Current list of affected Linux distros



RHEL (Red Hat Enterprise Linux) version 5.x, 6.x and 7.x
CentOS Linux version 5.x, 6.x & 7.x
Ubuntu Linux version 10.04, 12.04 LTS
Debian Linux version 7.x
Linux Mint version 13.0
Fedora Linux version 19 or older
SUSE Linux Enterprise 11 and older (also OpenSuse Linux 11 or older versions).
Arch Linux glibc version <= 2.18-1


What C library (Glibc) version does my Linux system use?


The easiest way to check the version number is to run the following command:



ldd --version


Sample outputs from RHEL/CentOS Linux v6.6:



ldd (GNU libc) 2.12
Copyright (C) 2010 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.


Sample outputs from Ubuntu Linux 12.04.5 LTS:



ldd (Ubuntu EGLIBC 2.15-0ubuntu10.9) 2.15
Copyright (C) 2012 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.


Sample outputs from Debian Linux v7.8:



ldd (Debian EGLIBC 2.13-38+deb7u6) 2.13
Copyright (C) 2011 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.


GHOST vulnerability check



/* ghosttest.c: GHOST vulnerability tester */
/* Credit: http://ift.tt/15JjIXr */
#include <netdb.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>

#define CANARY "in_the_coal_mine"

struct {
char buffer[1024];
char canary[sizeof(CANARY)];
} temp = { "buffer", CANARY };

int main(void) {
struct hostent resbuf;
struct hostent *result;
int herrno;
int retval;

/*** strlen (name) = size_needed - sizeof (*host_addr) - sizeof (*h_addr_ptrs) - 1; ***/
size_t len = sizeof(temp.buffer) - 16*sizeof(unsigned char) - 2*sizeof(char *) - 1;
char name[sizeof(temp.buffer)];
memset(name, '0', len);
name[len] = '\0';

retval = gethostbyname_r(name, &resbuf, temp.buffer, sizeof(temp.buffer), &result, &herrno);

if (strcmp(temp.canary, CANARY) != 0) {
puts("vulnerable");
exit(EXIT_SUCCESS);
}
if (retval == ERANGE) {
puts("not vulnerable");
exit(EXIT_SUCCESS);
}
puts("should not happen");
exit(EXIT_FAILURE);
}


Compile and run it as follows:



$ gcc ghosttest.c -o ghosttest
$ ./ghosttest


Sample outputs from patched Debian v7.8 server:



not vulnerable


Sample outputs from unpatched Ubuntu 12.04 LTS server:



vulnerable


Red Hat Access Lab: GHOST tool



#!/bin/bash
# rhel-GHOST-test.sh - GHOST vulnerability tester. Only for CentOS/RHEL based servers. #
# Credit : Red Hat, Inc - http://ift.tt/1z2RKSC #
vercomp () {
if [[ $1 == $2 ]]
then
return 0
fi
local IFS=.
local i ver1=($1) ver2=($2)
# fill empty fields in ver1 with zeros
for ((i=${#ver1[@]}; i<${#ver2[@]}; i++))
do
ver1[i]=0
done
for ((i=0; i<${#ver1[@]}; i++))
do
if [[ -z ${ver2[i]} ]]
then
# fill empty fields in ver2 with zeros
ver2[i]=0
fi
if ((10#${ver1[i]} > 10#${ver2[i]}))
then
return 1
fi
if ((10#${ver1[i]} < 10#${ver2[i]}))
then
return 2
fi
done
return 0
}

glibc_vulnerable_version=2.17
glibc_vulnerable_revision=54
glibc_vulnerable_version2=2.5
glibc_vulnerable_revision2=122
glibc_vulnerable_version3=2.12
glibc_vulnerable_revision3=148
echo "Vulnerable glibc version <=" $glibc_vulnerable_version"-"$glibc_vulnerable_revision
echo "Vulnerable glibc version <=" $glibc_vulnerable_version2"-"$glibc_vulnerable_revision2
echo "Vulnerable glibc version <=" $glibc_vulnerable_version3"-1."$glibc_vulnerable_revision3

glibc_version=$(rpm -q glibc | awk -F"[-.]" '{print $2"."$3}' | sort -u)
if [[ $glibc_version == $glibc_vulnerable_version3 ]]
then
glibc_revision=$(rpm -q glibc | awk -F"[-.]" '{print $5}' | sort -u)
else
glibc_revision=$(rpm -q glibc | awk -F"[-.]" '{print $4}' | sort -u)
fi
echo "Detected glibc version" $glibc_version" revision "$glibc_revision

vulnerable_text=$"This system is vulnerable to CVE-2015-0235. <http://ift.tt/1z2RJ19;
Please refer to <http://ift.tt/1z2RKSG; for remediation steps"

if [[ $glibc_version == $glibc_vulnerable_version ]]
then
vercomp $glibc_vulnerable_revision $glibc_revision
elif [[ $glibc_version == $glibc_vulnerable_version2 ]]
then
vercomp $glibc_vulnerable_revision2 $glibc_revision
elif [[ $glibc_version == $glibc_vulnerable_version3 ]]
then
vercomp $glibc_vulnerable_revision3 $glibc_revision
else
vercomp $glibc_vulnerable_version $glibc_version
fi

case $? in
0) echo "$vulnerable_text";;
1) echo "$vulnerable_text";;
2) echo "Not Vulnerable.";;
esac


Sample outputs from patched RHEL v6.8 server:



bash rhel-GHOST-test.sh
Vulnerable glibc version <= 2.17-54
Vulnerable glibc version <= 2.5-122
Vulnerable glibc version <= 2.12-1.148
Detected glibc version 2.12 revision 149
Not Vulnerable.


Due to the large number of applications/system utilities dependent on glibc, a restart is recommended after patching to ensure the patch takes affect.




Patching


Fix the GHOST vulnerability on a CentOS/RHEL/Fedora/Scientific Linux



sudo yum clean all
sudo yum update


Now restart to take affect:



sudo reboot


Fix the GHOST vulnerability on a Ubuntu Linux



sudo apt-get clean
sudo apt-get update
sudo apt-get dist-upgrade


Restart:



sudo reboot


Fix the GHOST vulnerability on a Debian Linux



sudo apt-get clean
sudo apt-get update
sudo apt-get dist-upgrade


Restart:



sudo reboot


Sources (and more information):



  1. http://ift.tt/1D6g3xY

  2. http://ift.tt/1toaKKf

  3. http://ift.tt/15JjIXr



Aucun commentaire:

Enregistrer un commentaire