Linux Glibc庫安全性漏洞修檢測

標籤：linux glibc庫安全性漏洞修檢測

1. 代碼編輯

#include <netdb.h>   #include <stdio.h>   #include <stdlib.h>   #include <string.h>   #include <errno.h>   #define CANARY  "in_the_coal_mine"   struct {     char buffer[1024];     char canary[sizeof(CANARY)];   } temp = { "buffer", CANARY };   int main(void) {     struct hostent resbuf;     struct hostent *result;     int herrno;     int retval;     /*** strlen (name) = size_needed -sizeof (*host_addr) - sizeof (*h_addr_ptrs) - 1; ***/     size_t len = sizeof(temp.buffer) -16*sizeof(unsigned char) - 2*sizeof(char *) - 1;     char name[sizeof(temp.buffer)];     memset(name, ‘0‘, len);     name[len] = ‘\0‘;     retval = gethostbyname_r(name,&resbuf, temp.buffer, sizeof(temp.buffer), &result, &herrno);     if (strcmp(temp.canary, CANARY) !=0) {       puts("vulnerable");       exit(EXIT_SUCCESS);     }     if (retval == ERANGE) {       puts("notvulnerable");       exit(EXIT_SUCCESS);     }     puts("should nothappen");     exit(EXIT_FAILURE);   } 

2. 編譯代碼

$gcc GHOST.c -o GHOST

3. 漏洞檢測：
$./GHOST   
vulnerable 
表示存在漏洞，需要進行修複。 
 
$./GHOST   
notvulnerable 
表示修複成功。

4. 漏洞修複

建議修補方案 
 
Centos 5/6/7：
yum update glibc
 
Ubuntu 12/14
apt-get update
apt-get install libc6
 
Debian 6
wget -O /etc/apt/sources.list.d/debian6-lts.list http://mirrors.aliyun.com/repo/debian6-lts.list
apt-get update
apt-get install libc6
 
Debian 7
apt-get update
apt-get install libc6
 
Opensuse 13
zypper refresh
zypper update glibc*

Linux Glibc庫安全性漏洞修檢測