SliTaz Forum

james.novell

Member

Registered: 2015-01-29

Posts: 3

CVE-2015-0235 GHOST slitaz-cooking and slitaz4.0 glibc 2.14.1 and glibc 2.13

Hi, there is a CVE-2015-0235 GHOST vulnerability in glibc libraries which all slitaz versions are using.

glibc versions vulnerable: 2.2 - 2.18.

vulnerability was fixed in commit:

https://sourceware.org/git/?p=glibc.git;a=commit;h=d5dd6189d506068ed11c8bfa1e1e9bffde04decd

Could you please upgrade glibc or just suggest me short way how it can be done?

Vulnerable functions: gethostbyname and gethostbyname2 which are using by many daemons.

kultex

Administrator

Registered: 2011-03-28

Posts: 1,175

Re: CVE-2015-0235 GHOST slitaz-cooking and slitaz4.0 glibc 2.14.1 and glibc 2.13

http://hg.slitaz.org/wok-stable/rev/0ef4ad6ff5da

http://hg.slitaz.org/wok/rev/705629de834c

james.novell

Member

Registered: 2015-01-29

Posts: 3

Re: CVE-2015-0235 GHOST slitaz-cooking and slitaz4.0 glibc 2.14.1 and glibc 2.13

glibc seems successfully updated by cook, but when I did upgrade I can see that CVE-2015-0235 seems isn't patched:

$ wget --no-check-certificate https://gist.githubusercontent.com/koelling/ef9b2b9d0be6d6dbab63/raw/de1730049198c64eaf8f8ab015a3c8b23b63fd34/gistfile1.c

$ gcc gistfile1.c

$ ./a.out

vulnerable

mojo

Administrator

Registered: 2011-03-29

Posts: 2,174

Re: CVE-2015-0235 GHOST slitaz-cooking and slitaz4.0 glibc 2.14.1 and glibc 2.13

Slitaz-4.0 and Slitaz-5.0 tested as not vulnerable after installing patched glibc downloaded from build server and rebooting.

It will take a while for packages to propagate to mirrors.

Write test code to file GHOST.c

[c]cat > GHOST.c << EOF
#include <netdb.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>

#define CANARY "in_the_coal_mine"

struct {
  char buffer[1024];
  char canary[sizeof(CANARY)];
} temp = { "buffer", CANARY };

int main(void) {
  struct hostent resbuf;
  struct hostent *result;
  int herrno;
  int retval;

  /*** strlen (name) = size_needed - sizeof (*host_addr) - sizeof (*h_addr_ptrs) - 1; ***/
  size_t len = sizeof(temp.buffer) - 16*sizeof(unsigned char) - 2*sizeof(char *) - 1;
  char name[sizeof(temp.buffer)];
  memset(name, '0', len);
  name[len] = '';

  retval = gethostbyname_r(name, &resbuf, temp.buffer, sizeof(temp.buffer), &result, &herrno);

  if (strcmp(temp.canary, CANARY) != 0) {
    puts("vulnerable");
    exit(EXIT_SUCCESS);
  }
  if (retval == ERANGE) {
    puts("not vulnerable");
    exit(EXIT_SUCCESS);
  }
  puts("should not happen");
  exit(EXIT_FAILURE);
}
EOF[/c]
Compile GHOST.c and run:

[c]gcc GHOST.c -o GHOST && ./GHOST[/c]

sixofeight

Member

Registered: 2013-07-02

Posts: 234

Re: CVE-2015-0235 GHOST slitaz-cooking and slitaz4.0 glibc 2.14.1 and glibc 2.13

Hi

Thanks for the quick fix

Now I have a Question (just to be sure before I'm remastering all my iso's)

I'm using SliTaz4 and looking into /var/lib/tazpkg/installed.md5 shows me

that I have only "glibc-base" installed.

Would it be enough to update only this package (in my case)?

And if yes,which one is the right one, because downloading this package

gave me various md5 sums.

Is this the correct one:

a449ce805511cabc7739598aeef6a880  glibc-base-2.13.tazpkg ?

thanks

james.novell

Member

Registered: 2015-01-29

Posts: 3

Re: CVE-2015-0235 GHOST slitaz-cooking and slitaz4.0 glibc 2.14.1 and glibc 2.13

Thanks, now it works fine in all slitaz types.

sixofeight, updating glibc-base should be enough for your case, and yes, a449ce805511cabc7739598aeef6a880 is the correct one for glibc-base-2.13.

sixofeight

Member

Registered: 2013-07-02

Posts: 234

Re: CVE-2015-0235 GHOST slitaz-cooking and slitaz4.0 glibc 2.14.1 and glibc 2.13

@ james.novell

Thanks for the confirmation.

Have a nice day.