Glibc getaddrinfo stack-based buffer overflow

Re:Glibc getaddrinfo stack-based buffer overflow by Gratsby on Tuesday February 16, 2016 @02:07PM (#11112298)

Has anyone put together a POC that doesn't require re-pointing the system nameserver and crashing other applications?

[ Parent | on HN ]

Re:Glibc getaddrinfo stack-based buffer overflow by arbruijn on Tuesday February 16, 2016 @04:39PM (#11113315)

You can create a small chroot with a custom resolv.conf.

Example (tested on Ubuntu 14.04 64-bit):

  mkdir -p root/lib/x86_64-linux-gnu root/lib64 root/etc
  cp -a --parents /lib/x86_64-linux-gnu/lib{c,nss,resolv}* root
  cp /lib64/ld-linux-x86-64.so.2 root/lib64
  cp CVE-2015-7547-client root
  echo 'nameserver 127.0.0.1' > root/etc/resolv.conf
  sudo chroot root ./CVE-2015-7547-client

If it prints nothing it crashed. Try running with strace to be sure.

[ Parent | on HN ]

Re:Glibc getaddrinfo stack-based buffer overflow by Gratsby on Tuesday February 16, 2016 @05:24PM (#11113601)

Brilliant. Thank you.

[ Parent | on HN ]

Re:Glibc getaddrinfo stack-based buffer overflow by zwetan on Tuesday February 16, 2016 @04:01PM (#11113102)

I'm interested in that too

[ Parent | on HN ]