幽靈漏洞(GHOST)檢測(cè)方法及修復(fù)建議
0x01 前言
昨日，【CVE 2015-0235: GNU glibc gethostbyname 緩沖區(qū)溢出漏洞 】全面爆發(fā)，該漏洞的產(chǎn)生是Qualys公司在進(jìn)行內(nèi)部代碼審核時(shí)，發(fā)現(xiàn)了一個(gè)在GNU C庫(glibc)中存在的__nss_hostname_digits_dots函數(shù)導(dǎo)致的緩沖區(qū)溢出漏洞。這個(gè)bug可以通過gethostbyname *()函數(shù)來觸發(fā)，本地和遠(yuǎn)程均可行。該漏洞(幽靈漏洞)造成了遠(yuǎn)程代碼執(zhí)行，攻擊者可以利用此漏洞遠(yuǎn)程獲取系統(tǒng)進(jìn)程當(dāng)前的權(quán)限。
鑒于網(wǎng)上諸多glibc的原理普及，本文章就不多啰嗦了，直接實(shí)踐如何檢測(cè)服務(wù)器是否存在該漏洞，以及修復(fù)漏洞的方法。
0x02 檢測(cè)是否存在幽靈漏洞(GHOST)
檢測(cè)方法1【RedHat官方檢測(cè)方法】：
ghost_check.sh源碼:
- #!/bin/bash
- vercomp () {
- if [[ $1 == $2 ]]
- then
- return 0
- fi
- local IFS=.
- local i ver1=($1) ver2=($2)
- # fill empty fields in ver1 with zeros
- for ((i=${#ver1[@]}; i<${#ver2[@]}; i++))
- do
- ver1[i]=0
- done
- for ((i=0; i<${#ver1[@]}; i++))
- do
- if [[ -z ${ver2[i]} ]]
- then
- # fill empty fields in ver2 with zeros
- ver2[i]=0
- fi
- if ((10#${ver1[i]} > 10#${ver2[i]}))
- then
- return 1
- fi
- if ((10#${ver1[i]} < 10#${ver2[i]}))
- then
- return 2
- fi
- done
- return 0
- }
- glibc_vulnerable_version=2.17
- glibc_vulnerable_revision=54
- glibc_vulnerable_version2=2.5
- glibc_vulnerable_revision2=122
- glibc_vulnerable_version3=2.12
- glibc_vulnerable_revision3=148
- echo "Vulnerable glibc version <=" $glibc_vulnerable_version"-"$glibc_vulnerable_revision
- echo "Vulnerable glibc version <=" $glibc_vulnerable_version2"-"$glibc_vulnerable_revision2
- echo "Vulnerable glibc version <=" $glibc_vulnerable_version3"-1."$glibc_vulnerable_revision3
- glibc_version=$(rpm -q glibc | awk -F"[-.]" '{print $2"."$3}' | sort -u)
- if [[ $glibc_version == $glibc_vulnerable_version3 ]]
- then
- glibc_revision=$(rpm -q glibc | awk -F"[-.]" '{print $5}' | sort -u)
- else
- glibc_revision=$(rpm -q glibc | awk -F"[-.]" '{print $4}' | sort -u)
- fi
- echo "Detected glibc version" $glibc_version" revision "$glibc_revision
- vulnerable_text=$"This system is vulnerable to CVE-2015-0235. <https://access.redhat.com/security/cve/CVE-2015-0235>
- Update the glibc and ncsd packages on your system using the packages released with the following:
- yum install glibc"
- if [[ $glibc_version == $glibc_vulnerable_version ]]
- then
- vercomp $glibc_vulnerable_revision $glibc_revision
- elif [[ $glibc_version == $glibc_vulnerable_version2 ]]
- then
- vercomp $glibc_vulnerable_revision2 $glibc_revision
- elif [[ $glibc_version == $glibc_vulnerable_version3 ]]
- then
- vercomp $glibc_vulnerable_revision3 $glibc_revision
- else
- vercomp $glibc_vulnerable_version $glibc_version
- fi
- case $? in
- 0) echo "$vulnerable_text";;
- 1) echo "$vulnerable_text";;
- 2) echo "Not Vulnerable.";;
- esac
檢測(cè)方法2【簡(jiǎn)單的檢測(cè)方法】：
檢測(cè)方法2源碼:
- /usr/sbin/clockdiff `python -c "print '0' * $((0x10000-16*1-2*4-1-4))"`
檢測(cè)方法3【二進(jìn)制檢測(cè)方法】：
ghost.c源碼:
- #include <netdb.h>
- #include <stdio.h>
- #include <stdlib.h>
- #include <string.h>
- #include <errno.h>
- #define CANARY "in_the_coal_mine"
- struct {
- char buffer[1024];
- char canary[sizeof(CANARY)];
- } temp = { "buffer", CANARY };
- int main(void) {
- struct hostent resbuf;
- struct hostent *result;
- int herrno;
- int retval;
- /*** strlen (name) = size_needed - sizeof (*host_addr) - sizeof (*h_addr_ptrs) - 1; ***/
- size_t len = sizeof(temp.buffer) - 16*sizeof(unsigned char) - 2*sizeof(char *) - 1;
- char name[sizeof(temp.buffer)];
- memset(name, '0', len);
- name[len] = '\0';
- retval = gethostbyname_r(name, &resbuf, temp.buffer, sizeof(temp.buffer), &result, &herrno);
- if (strcmp(temp.canary, CANARY) != 0) {
- puts("vulnerable");
- exit(EXIT_SUCCESS);
- }
- if (retval == ERANGE) {
- puts("not vulnerable");
- exit(EXIT_SUCCESS);
- }
- puts("should not happen");
- exit(EXIT_FAILURE);
- }
#p#
0x03 在線修復(fù)方案
CentOS, Red Hat, Fedora等系列衍生版本(RHN建議)：
- yum update glibc
Debian, Ubuntu等系列衍生版本：
- apt-get clean && apt-get update && apt-get upgrade
#p#
0x04 離線修復(fù)方案
Centos6.5離線補(bǔ)丁
先檢查本地glibc包安裝了哪些相關(guān)包
- rpm -qa|grep glibc
然后，到阿里源下載對(duì)應(yīng)版本
- cat > update.txt << EOF
- http://mirrors.aliyun.com/centos/6.6/updates/x86_64/Packages/glibc-2.12-1.149.el6_6.5.i686.rpm
- http://mirrors.aliyun.com/centos/6.6/updates/x86_64/Packages/glibc-2.12-1.149.el6_6.5.x86_64.rpm
- http://mirrors.aliyun.com/centos/6.6/updates/x86_64/Packages/glibc-common-2.12-1.149.el6_6.5.x86_64.rpm
- http://mirrors.aliyun.com/centos/6.6/updates/x86_64/Packages/glibc-devel-2.12-1.149.el6_6.5.x86_64.rpm
- http://mirrors.aliyun.com/centos/6.6/updates/x86_64/Packages/glibc-headers-2.12-1.149.el6_6.5.x86_64.rpm
- EOF
進(jìn)行后臺(tái)斷點(diǎn)下載補(bǔ)丁包
- wget -b -i update.txt -c
使用yum本地安裝
- yum localinstall glibc-*
或是rpm安裝
- rpm -ivUh glibc-*
Red Had系列衍生版本
使用方法參考上文【Centos6.5離線補(bǔ)丁】的修補(bǔ)方法
http://mirrors.aliyun.com/centos/7/updates/x86_64/Packages/glibc-2.17-55.el7_0.5.i686.rpm
http://mirrors.aliyun.com/centos/7/updates/x86_64/Packages/glibc-2.17-55.el7_0.5.x86_64.rpm
0x05 修復(fù)完成檢測(cè)
ghost_check.sh腳本檢測(cè)
ghost.c腳本檢測(cè)
注意：打好補(bǔ)丁后必須立即重啟操作系統(tǒng)，否則會(huì)造成應(yīng)用業(yè)務(wù)無法使用。
0x06 參考來源
redhat官方
https://access.redhat.com/articles/1332213
redhat官方補(bǔ)丁介紹:
https://rhn.redhat.com/errata/RHSA-2015-0090.html
https://rhn.redhat.com/errata/RHSA-2015-0092.html
ubuntu官方補(bǔ)丁介紹:
http://www.ubuntu.com/usn/usn-2485-1/
