Qualys discovered a critical buffer overflow in the gethostbyname() and gethostbyname2() functions in glibc. According to the announcement by Qualys, they were able to create an in-house exploit that will execute arbitrary code via the Exim mail server. [1] glibc before version 2.18 (released August ) is vulnerable. You can quickly check your glibc version by using "ldd --version" (but not all Unix systems that use glibc have ldd installed, and some software is statically compiled with glibc) These glibc functions are used on most (all?) Unix systems to resolve hostnames . Any software that at some point resolved host names is potentially vulnerable, which includes pretty much all software that uses the network in some from (clients and servers). The problem has been fixed in some versions of glibc, but it was originally not recognized as a security vulnerability, and as a result not backported in older, still widely used and supported versions of glibc. What should you do: Apply this update as soon as you see patched offered by your Linux/Unix distribution. Some Windows software (and of course OS X) uses glibc as well and may be vulnerable. Use the getaddrinfo() function, not gethostbyname() [1] http://openwall.com/lists/oss-security/2015/01/27/9 Additional resources: You shouldn't be using gethostbyname() anyway - Robert Graham, Errata Security Highly critical “Ghost” allowing code execution affects most Linux systems - Dan Goodin, Ars Technica GHOST glibc Remote Code Execution Vulnerability Affects All Linux Systems - Michael Mimoso, Threatpost Linux Ghost Remote Code Execution Vulnerability - US-CERT --- |
Johannes 4074 Posts ISC Handler Jan 27th 2015 |
Thread locked Subscribe |
Jan 27th 2015 6 years ago |
I wouldn't actually overreact here. While this is a serious vulnerablity, it is not easy to exploit and the attack surface is pretty much limited. EXIM has found to be vulnerable by Qualys, but many other major services are not vulnerable (i. e. Postfix, Apache, nginx, lighttpd, pureftpd, proftpd, etc.). This needs to be patched for sure, but I think there is no need to react overhasty, but in a calm and ordered manner instead.
|
Anonymous |
Quote |
Jan 28th 2015 6 years ago |
So my understanding is that so far, the only verified attack vector would be a Linux box running SMTP? Or is that an oversimplification?
|
JeffSoh 31 Posts |
Quote |
Jan 28th 2015 6 years ago |
Suck it Ubuntu nerds, Gentoo is invulnerable...
|
Anonymous |
Quote |
Jan 28th 2015 6 years ago |
Sign Up for Free or Log In to start participating in the conversation!