Linux vulnerability announced

On the 27th of January 2015, a vulnerability named GHOST (CVE-2015-0235) was announced. This exploit was identified in a common linux package known as GNU C library (glibc).

An attacker who exploits this issue can gain complete control of the compromised system.

This affects most Linux flavours and most servers will be affected as this package is a common package to have installed.

The vulnerability was code named “GHOST” for easy reference.

Vulnerability Info

The “GHOST” vulnerability was due to a bug in the code of the GNU C Library package that allowed for someone to gain full access to a server if they are able to exploit the identified bug.

Depending on the server, the bug could be exploited remotely or locally through certain calls that are passed through the glibc package by varying different applications like DNS, PHP or Exim for example.

Current affected Linux distributions include:

  • RHEL (Red Hat Enterprise Linux) version 5.x, 6.x and 7.x
  • CentOS Linux version 5.x, 6.x & 7.x
  • Ubuntu Linux version 10.04, 12.04 LTS
  • Debian Linux version 7.x
  • Fedora Linux version 19 or older

Interesting note is that some flavours were not affected as the code was addressed in certain versions of the glibc package, however those fixed versions were not included in some Linux flavours.

Technical Info

For the more technical inclined the exploit exists in the “he __nss_hostname_digits_dots()” function of the glibc package.

If you would like to quickly test if your system is vulnerable you will need to run the following command as root (or user with similar permissions),

ldd --version

The output should look something like below,

ldd (GNU libc) 2.12
ldd (Ubuntu EGLIBC 2.15-0ubuntu10.9) 2.15
ldd (Debian EGLIBC 2.13-38+deb7u6) 2.13

Those versions of the glibc package are vulnerable and need to be patched.

Another more detailed test is to run a C script that actually checks for the exploit. This is an advanced test and should only be done by users who understand C, compiling and gcc.

Create the following text file named “ghostest.c”:

/* ghosttest.c:  GHOST vulnerability tester */
/* Credit: http://www.openwall.com/lists/oss-security/2015/01/27/9 */
#include <netdb.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
 
#define CANARY "in_the_coal_mine"
 
struct {
  char buffer[1024];
  char canary[sizeof(CANARY)];
} temp = { "buffer", CANARY };
 
int main(void) {
  struct hostent resbuf;
  struct hostent *result;
  int herrno;
  int retval;
 
  /*** strlen (name) = size_needed - sizeof (*host_addr) - sizeof (*h_addr_ptrs) - 1; ***/
  size_t len = sizeof(temp.buffer) - 16*sizeof(unsigned char) - 2*sizeof(char *) - 1;
  char name[sizeof(temp.buffer)];
  memset(name, '0', len);
  name[len] = '';
 
  retval = gethostbyname_r(name, &resbuf, temp.buffer, sizeof(temp.buffer), &result, &herrno);
 
  if (strcmp(temp.canary, CANARY) != 0) {
    puts("vulnerable");
    exit(EXIT_SUCCESS);
  }
  if (retval == ERANGE) {
    puts("not vulnerable");
    exit(EXIT_SUCCESS);
  }
  puts("should not happen");
  exit(EXIT_FAILURE);
}

Compile and run it as follows:

$ gcc ghosttest.c -o ghosttest
$ ./ghosttest

You will now either get an output of either “not vulnerable” or “vulnerable”.

Want To Know More

If you are interested to understand more about this exploit. Please see the following links: