This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Warning: GHOST bug in glibc

Hello everyone,

In case you haven't noticed, there is a critical bug going around these days in glibc that has successfully been remotely exploited through gethostbyname in exim (and possibly everywhere in Linux where a name is resolved):

oss-security - Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow

I was unable to quickly assess if UTM is affected. Since the bug only affect older versions of glibc (2.17 and down. 2.18 and up are safe), it is likely not a problem. However, you might want to keep an eye on news.

That old bug wasn't thought to be a security issue until recently. Now, POC against exim has been already tested and metasploit is adding a module to it's catalog (should be there soon).

I'm sure the community would appreciate a work from Sophos regarding this (which version of UTM - if any - is affected). At the very lest, I would [:P]

Some extra info:

https://security-tracker.debian.org/tracker/CVE-2015-0235
Highly critical

Edit:
"ldd --version" returns "ldd (GNU libc) 2.11.3". Looks like we might be looking at an emergency patch and reboot.

This thread was automatically locked due to age.

0 teched_01 over 10 years ago

More granular date stamping and an open changelog would be helpful for such KBAs.
Cancel
Vote Up 0 Vote Down

Cancel
0 NewImage over 10 years ago

Fix:
Update your UTM to the fixed version.
Fixed in version: 9.307
Release: 2nd February
Cancel
Vote Up 0 Vote Down

Cancel
0 eclipse79oldacct over 10 years ago in reply to NewImage

Fix:
Update your UTM to the fixed version.
Fixed in version: 9.307
Release: 2nd February

Considering that in this case the fix will be released also for 9.2x users, the quesiton is: it's more reliable to upgrade to 9.211 or to 8.307? In my case, since I cannot see 9.3x update, if I want 9.3 version I have to manually install this patch ftp://ftp.astaro.com/UTM/v9/up2date/u2d-sys-9.210020-304009.tgz.gpg. I think that upgrading to 9.211 I will not able to migrate to 9.3x for the moment, isnt'it?

Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 10 years ago in reply to eclipse79oldacct

I wouldn't be in a hurry to go to 9.3xx at all -- too many lingering issues. I'd go with 9.211 (9.210 is fine once you manually fix the SSLv3 issues with SMTP via a Sophos KB).
Cancel
Vote Up 0 Vote Down

Cancel
0 TheDrew over 10 years ago in reply to Ákos Szalkai

Well, chroot is not a security feature.

https://securityblog.redhat.com/2013/03/27/is-chroot-a-security-feature/

I've read that article and while I agree he does have a point that you can pretty much achieve the same using proper filesystem permissions, I disagree with his statement that chroot is not a security feature.

Hardening a server is one aspect of protecting a server (aka a security feature), alongside a holistic approach of external firewalls, IDS/IPS, and secure design (systems & sosftware). But he's saying that chroot() is a hardening feature, not a security feature, even tho hardening features are, by definition security features. Can't have it both ways. [:)]

Or, maybe I'm just anal about semantics.[:D]
Cancel
Vote Up 0 Vote Down

Cancel
0 Billybob over 10 years ago in reply to TheDrew

@TheDrew: Redhat guys always pushing selinux no matter what [;)]

Back on topic though, I am a little concerned with the way sophos is casually handling this situation. We are not only running older glibc, we also have Exim as our internet facing MTA which is directly affected by this bug. Why not just update the glibc to the latest version and do a soft release. That way in the next five days, we can iron out some bugs before a wider GA release [:S]

Also since 9.2 is still widely deployed due to selective release of 9.3, why Feb 5th for the same patch? Sophos running short on developers or QA or both?
Cancel
Vote Up 0 Vote Down

Cancel
0 fw115 over 10 years ago in reply to Billybob

Update your UTM to the fixed version.

Fixed in version: 9.307

Release: 2nd February

This is a joke ! How long is this issue now ? For a Security relevant component ?

Man since shohos got in here things going more and more downhill with the astaro stuff....
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 10 years ago in reply to fw115

9.307 update info:

UTM Up2Date 9.307 Released | Sophos Blog
Cancel
Vote Up 0 Vote Down

Cancel
0 StephaneGROBETY over 10 years ago

I installed it in our main office today: working fine so far. It's scheduled for deployment in production tomorrow for our general users. I'll let you know if there is any issue (beyond the ones still existing in 9.3xx)
Cancel
Vote Up 0 Vote Down

Cancel
0 StephaneGROBETY over 10 years ago

Hm:

firewall:/loginuser # ldd --version
ldd (GNU libc) 2.11.3

After patching. WTF ??
Cancel
Vote Up 0 Vote Down

Cancel