{"id":406,"date":"2015-01-30T17:48:21","date_gmt":"2015-01-30T17:48:21","guid":{"rendered":"8cb22bdd0b7ba1ab13d742e22eed8da2"},"modified":"2015-01-30T17:48:21","modified_gmt":"2015-01-30T17:48:21","slug":"","status":"publish","type":"post","link":"https:\/\/www.xiaobo.li\/notes\/archives\/406","title":{"rendered":"glibc bug"},"content":{"rendered":"

Linux GNU glibc\u6807\u51c6\u5e93\u7684 gethostbyname\u51fd\u6570\u7206\u51fa\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u6f0f\u6d1e\u7f16\u53f7\u4e3aCVE-2015-0235\u3002\u9ed1\u5ba2\u53ef\u4ee5\u901a\u8fc7gethostbyname\u7cfb\u5217\u51fd\u6570\u5b9e\u73b0\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\uff0c\u83b7\u53d6\u670d\u52a1\u5668\u7684\u63a7\u5236\u6743\u53caShell\u6743\u9650
\n 
\n\u4e00\u3001    \u6f0f\u6d1e\u53d1\u5e03\u65e5\u671f  <\/strong>
\n2015\u5e741\u670827\u65e5 
\n 
\n\u4e8c\u3001    \u5df2\u786e\u8ba4\u88ab\u6210\u529f\u5229\u7528\u7684\u8f6f\u4ef6\u53ca\u7cfb\u7edf  <\/strong>
\nGlibc 2.2\u52302.17 (\u5305\u542b2.2\u548c2.17\u7248\u672c) 
\n 
\n\u4e09\u3001    \u6f0f\u6d1e\u63cf\u8ff0  <\/strong>
\nGNU glibc\u6807\u51c6\u5e93\u7684gethostbyname \u51fd\u6570\u7206\u51fa\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u6f0f\u6d1e\u7f16\u53f7\uff1aCVE-2015-0235\u3002 Glibc \u662f\u63d0\u4f9b\u7cfb\u7edf\u8c03\u7528\u548c\u57fa\u672c\u51fd\u6570\u7684 C \u5e93\uff0c\u6bd4\u5982open, malloc, printf\u7b49\u7b49\u3002\u6240\u6709\u52a8\u6001\u8fde\u63a5\u7684\u7a0b\u5e8f\u90fd\u8981\u7528\u5230Glibc\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8fd9\u4e2a\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u4ee3\u7801\u5e76\u63d0\u5347\u8fd0\u884c\u5e94\u7528\u7a0b\u5e8f\u7684\u7528\u6237\u7684\u6743\u9650\u3002 
\n 
\n\u56db\u3001    \u6f0f\u6d1e\u68c0\u6d4b\u65b9\u6cd5  <\/strong>
\n\u8bf7\u81ea\u884c\u68c0\u6d4b\uff1a 
\n[[test]] 
\n$ cat > GHOST.c << EOF 
\n#include <netdb.h> 
\n#include <stdio.h> 
\n#include <stdlib.h> 
\n#include <string.h> 
\n#include <errno.h> 
\n#define CANARY\"in_the_coal_mine\" 
\nstruct { 
\n  char buffer[1024]; 
\n  char canary[sizeof(CANARY)]; 
\n} temp = { \"buffer\", CANARY }; 
\nint main(void) { 
\n  struct hostent resbuf; 
\n  struct hostent *result; 
\n  int herrno; 
\n  int retval; 
\n  \/*** strlen (name) = size_needed -sizeof (*host_addr) - sizeof (*h_addr_ptrs) - 1; ***\/ 
\n  size_t len = sizeof(temp.buffer) -16*sizeof(unsigned char) - 2*sizeof(char *) - 1; 
\n  char name[sizeof(temp.buffer)]; 
\n  memset(name, '0', len); 
\n  name[len] = '\\0'; 
\n  retval = gethostbyname_r(name,&resbuf, temp.buffer, sizeof(temp.buffer), &result, &herrno); 
\n  if (strcmp(temp.canary, CANARY) !=0) { 
\n    puts(\"vulnerable\"); 
\n    exit(EXIT_SUCCESS); 
\n  } 
\n  if (retval == ERANGE) { 
\n    puts(\"notvulnerable\"); 
\n    exit(EXIT_SUCCESS); 
\n  } 
\n  puts(\"should nothappen\"); 
\n  exit(EXIT_FAILURE); 
\n} 
\nEOF 
\n[test] 
\n$ gcc GHOST.c -o GHOST 
\n[test] 
\n$.\/GHOST 
\nvulnerable 
\n 
\n\u4e94\u3001    \u5efa\u8bae\u4fee\u8865\u65b9\u6848  <\/strong>
\n 
\n 
\nCentos 5\/6\/7\uff1a
\n 
\n 
\nyum update glibc<\/p>\n

 <\/p>\n

\u8d44\u6599\u6765\u6e90\uff1ahttp:\/\/bbs.aliyun.com\/read\/227885.html<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Linux GNU glibc\u6807\u51c6\u5e93\u7684 gethostbyname\u51fd\u6570\u7206\u51fa\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u6f0f\u6d1e\u7f16\u53f7\u4e3aCVE-2015-0235\u3002\u9ed1\u5ba2\u53ef\u4ee5\u901a\u8fc7gethostbyname\u7cfb\u5217\u51fd\u6570\u5b9e\u73b0\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\uff0c\u83b7\u53d6\u670d\u52a1\u5668\u7684\u63a7\u5236\u6743\u53caShell\u6743\u9650
\n 
\u4e00\u3001    \u6f0f\u6d1e\u53d1\u5e03\u65e5\u671f  <\/strong>
\n2015\u5e741\u670827\u65e5 
\n 
\u4e8c\u3001    \u5df2\u786e\u8ba4\u88ab\u6210\u529f\u5229\u7528\u7684\u8f6f\u4ef6\u53ca\u7cfb\u7edf  <\/strong>
\nGlibc 2.2\u52302.17 (\u5305\u542b2.2\u548c2.17\u7248\u672c) 
\n 
\u4e09\u3001    \u6f0f\u6d1e\u63cf\u8ff0&nbsp...<\/strong><\/p>\n

\u7ee7\u7eed\u9605\u8bfb →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[287],"tags":[197],"class_list":["post-406","post","type-post","status-publish","format-standard","hentry","category-linux","tag-glibc"],"_links":{"self":[{"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/posts\/406","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/comments?post=406"}],"version-history":[{"count":0,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/posts\/406\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/media?parent=406"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/categories?post=406"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.xiaobo.li\/notes\/wp-json\/wp\/v2\/tags?post=406"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}