CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow

Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by peterwwillis on Tuesday January 27, 2015 @11:34AM (#8953992)

They're only attacking host-lookup, so you just have to worry about people who can connect to your service and are able to control name server response. This means your network services that are internet-accessible. Everything else can wait for a maintenance window for the reboot.

  ~# netstat -lnp | grep -e "\(tcp.*LISTEN\|udp\)" | cut -d / -f 2- | sort -u
  cupsd          
  dnsmasq        
  httpd          
  nmbd           
  ntpd           
  qemu-kvm       
  rpc.portmap    
  rpc.statd      
  sendmail: acce 
  smbd           
  ssh           
  sshd

[ Parent | on HN ]

Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by jerematasno on Tuesday January 27, 2015 @08:34PM (#8957488)

It doesn't have to be internet accessible, AFAIK. If an attacker can get something to do arbitrary DNS lookups, I think it can be attacked. For instance, monitoring/log correlation software might be vulnerable.

[ Parent | on HN ]

Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by NickNameNick on Tuesday January 27, 2015 @10:57PM (#8958001)

If you have backend systems parsing XML, then an XXE[1] attack could trigger a DNS lookup, for example.

[1]https://www.owasp.org/index.php/XML_External_Entity_%28XXE%2...

[ Parent | on HN ]

Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by sarciszewski on Friday January 30, 2015 @12:50PM (#8973222)

Ooh, that could lead to some very interesting attack vectors. :D

[ Parent | on HN ]

Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by correxion on Tuesday January 27, 2015 @04:17PM (#8955981)

sudo netstat -lnp | awk -F/ '/LISTEN /{print $2}'

[ Parent | on HN ]