Linux Ghost Vulnerability CVE 2015-0235 (glibc patching scheme)

Vulnerability Hazard :

"CVE 2015-0235:gnu glibc gethostbyname buffer Overflow Vulnerability" is a full-blown outbreak that resulted in the discovery of a glibc in the GNU C library (__nss_hostname) when Qualys company was conducting internal code audits The _digits_dots function caused a buffer overflow vulnerability. This bug can be triggered by the gethostbyname * () function, both locally and remotely. The vulnerability (Ghost vulnerability) caused remote code execution, and an attacker could exploit this vulnerability to gain full control of the system.

Check to see if the system is storing phantom vulnerabilities:

Save the following code in the Check_yl.c file

#include <netdb.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <gnu/libc-version.h>
#define CANARY "In_the_coal_mine"
struct {
Char buffer[1024];
Char canary[sizeof (Canary)];
temp = {"Buffer", CANARY};
int main (void) {
struct hostent resbuf;
struct hostent *result;
int Herrno;
int retval;
/*** strlen (name) = Size_needed-sizeof (*host_addr)-sizeof (*H_ADDR_PTRS)-1; ***/
size_t len = sizeof (Temp.buffer)-16*sizeof (unsigned char)-2*sizeof (char *)-1;
Char name[sizeof (temp.buffer)];
memset (name, ' 0 ', Len);
Name[len] = ' + ';
retval = gethostbyname_r (name, &resbuf, Temp.buffer, sizeof (Temp.buffer), &result, &herrno);
if (strcmp (temp.canary, canary)! = 0) {
puts ("vulnerable");
exit (exit_success);
}
if (retval = = erange) {
puts ("not vulnerable");
exit (exit_success);
}
puts ("should not Happen");
exit (exit_failure);
}

And then compile the execution

#gcc check_yl.c-o cve-2015-0235./cve-2015-0235

If the result of the output is:vulnerable

Indicates that the system has this vulnerability. If not vulnerable indicates that the vulnerability does not exist

Patching scenarios:

To upgrade the glibc version, to patch this scenario, you need to upgrade the GLIBC to version 2.18 or 2.19.

#rpm-UVH--force--nodeps glibc-2.18-4.7.1.x86_64.rpm

Once the upgrade is complete, check to see if the upgrade was successful

#rpm-qi glibc

If the upgrade succeeds, then perform a command to check the vulnerability

#gcc check_yl.c-o cve-2015-0235./cve-2015-0235

Description The vulnerability has been patched successfully!

GLIBC Bag: http://pkgs.org/opensuse-13.1/opensuse-update/glibc-2.18-4.7.1.x86_64.rpm/download/

Ripple Range:

GLIBC Library versions 2.2, 2.17, and previous versions

Types of operating systems affected by the vulnerability:

CentOS 6 & 7Debian 7Red Hat Enterprise Linux 6 & 7Ubuntu 10.04 & 12.04
SuSE & 11 Linux distributions

Linux Ghost Vulnerability CVE 2015-0235 (glibc patching scheme)