This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Warning: GHOST bug in glibc

Hello everyone,

In case you haven't noticed, there is a critical bug going around these days in glibc that has successfully been remotely exploited through gethostbyname in exim (and possibly everywhere in Linux where a name is resolved):

oss-security - Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow

I was unable to quickly assess if UTM is affected. Since the bug only affect older versions of glibc (2.17 and down. 2.18 and up are safe), it is likely not a problem. However, you might want to keep an eye on news.

That old bug wasn't thought to be a security issue until recently. Now, POC against exim has been already tested and metasploit is adding a module to it's catalog (should be there soon).

I'm sure the community would appreciate a work from Sophos regarding this (which version of UTM - if any - is affected). At the very lest, I would [:P]

Some extra info:

https://security-tracker.debian.org/tracker/CVE-2015-0235
Highly critical

Edit:
"ldd --version" returns "ldd (GNU libc) 2.11.3". Looks like we might be looking at an emergency patch and reboot.

This thread was automatically locked due to age.

Parents

0 teched_01 over 10 years ago

Another thread outlines the packages in the 9.307 update: https://community.sophos.com/products/unified-threat-management/astaroorg/f/52/t/29877

It is not surprising that ldd --version reports 2.11.3.

It is common for security patches to be backported in "long-term-supported" and "enterprise" distributions. Review the Novell/SUSE link earlier in the thread.

Compare "rpm -qi glibc" output (install dates deliberately modified):

9.306


Name        : glibc                        Relocations: (not relocatable)

Version     : 2.11.3                            Vendor: Astaro GmbH & Co. KG

Release     : 17.54.1.1078.gb706d65.rb1     Build Date: Mon 27 May 2013 03:10:36                                                   PM EDT

Install Date: Fri 20 Jan 2015 00:00:00 AM EST      Build Host: axgbuild

Group       : System/Libraries              Source RPM: glibc-2.11.3-17.54.1.107                                                  8.gb706d65.rb1.src.rpm

Size        : 4840733                          License: BSD 3-Clause; GPL v2 or                                                   later; LGPL v2.1 or later

Signature   : (none)

Packager    : Astaro GmbH & Co. KG

URL         : http://www.gnu.org/software/libc/libc.html

Summary     : Standard Shared Libraries (from the GNU C Library)

Description :

The GNU C Library provides the most important standard libraries used

by nearly all programs: the standard C library, the standard math

library, and the POSIX thread library. A system is not functional

without these libraries.

Distribution: Astaro Security Gateway

9.307


Name        : glibc                        Relocations: (not relocatable)

Version     : 2.11.3                            Vendor: Astaro GmbH & Co. KG

Release     : 17.74.13.1439.g4e42d0f        Build Date: Thu 29 Jan 2015 05:07:29 AM EST

Install Date: Tue 03 Feb 2015 00:00:00 AM EST      Build Host: axgbuild

Group       : System/Libraries              Source RPM: glibc-2.11.3-17.74.13.1439.g4e42d0f.src.rpm

Size        : 4857288                          License: BSD 3-Clause; GPL v2 or later; LGPL v2.1 or later

Signature   : (none)

Packager    : Astaro GmbH & Co. KG

URL         : http://www.gnu.org/software/libc/libc.html

Summary     : Standard Shared Libraries (from the GNU C Library)

Description :

The GNU C Library provides the most important standard libraries used

by nearly all programs: the standard C library, the standard math

library, and the POSIX thread library. A system is not functional

without these libraries.

Distribution: Astaro Security Gateway

Reply

0 teched_01 over 10 years ago


Name        : glibc                        Relocations: (not relocatable)

Version     : 2.11.3                            Vendor: Astaro GmbH & Co. KG

Release     : 17.54.1.1078.gb706d65.rb1     Build Date: Mon 27 May 2013 03:10:36                                                   PM EDT

Install Date: Fri 20 Jan 2015 00:00:00 AM EST      Build Host: axgbuild

Group       : System/Libraries              Source RPM: glibc-2.11.3-17.54.1.107                                                  8.gb706d65.rb1.src.rpm

Size        : 4840733                          License: BSD 3-Clause; GPL v2 or                                                   later; LGPL v2.1 or later

Signature   : (none)

Packager    : Astaro GmbH & Co. KG

URL         : http://www.gnu.org/software/libc/libc.html

Summary     : Standard Shared Libraries (from the GNU C Library)

Description :

The GNU C Library provides the most important standard libraries used

by nearly all programs: the standard C library, the standard math

library, and the POSIX thread library. A system is not functional

without these libraries.

Distribution: Astaro Security Gateway

9.307


Name        : glibc                        Relocations: (not relocatable)

Version     : 2.11.3                            Vendor: Astaro GmbH & Co. KG

Release     : 17.74.13.1439.g4e42d0f        Build Date: Thu 29 Jan 2015 05:07:29 AM EST

Install Date: Tue 03 Feb 2015 00:00:00 AM EST      Build Host: axgbuild

Group       : System/Libraries              Source RPM: glibc-2.11.3-17.74.13.1439.g4e42d0f.src.rpm

Size        : 4857288                          License: BSD 3-Clause; GPL v2 or later; LGPL v2.1 or later

Signature   : (none)

Packager    : Astaro GmbH & Co. KG

URL         : http://www.gnu.org/software/libc/libc.html

Summary     : Standard Shared Libraries (from the GNU C Library)

Description :

The GNU C Library provides the most important standard libraries used

by nearly all programs: the standard C library, the standard math

library, and the POSIX thread library. A system is not functional

without these libraries.

Distribution: Astaro Security Gateway

Children

No Data