fix information</td>
</tr>
| Desktop (v. 5) |
fix available |
fixed in glibc-2.5-123.el5_11.1 |
| Desktop (v. 6) |
fix available |
fixed in glibc-2.12-1.149.el6_6.5 |
| Desktop (v. 7) |
fix available |
fixed in glibc-2.17-55.el7_0.5 |
| HPC Node (v. 6) |
fix available |
fixed in glibc-2.12-1.149.el6_6.5 |
| HPC Node (v. 7) |
fix available |
fixed in glibc-2.17-55.el7_0.5 |
| Server (v. 5) |
fix available |
fixed in glibc-2.5-123.el5_11.1 |
| Server (v. 6) |
fix available |
fixed in glibc-2.12-1.149.el6_6.5 |
| Server (v. 7) |
fix available |
fixed in glibc-2.17-55.el7_0.5 |
| Server EUS (v. 6.6.z) |
fix available |
fixed in glibc-2.12-1.149.el6_6.5 |
| Workstation (v. 6) |
fix available |
fixed in glibc-2.12-1.149.el6_6.5 |
| Workstation (v. 7) |
fix available |
fixed in glibc-2.17-55.el7_0.5 |
| RHEL 4 ELS |
fix available |
fixed in glibc-2.3.4-2.57.el4.2 |
Mint
|
| 13 "Maya" |
fix available |
Tracks Ubuntu 12.04, should get update from Ubuntu servers |
| 17 "Qiana" |
not vulnerable |
| 17.1 "Rebecca" |
not vulnerable |
Gentoo
libc information |
| stable |
not vulnerable |
uses glibc 2.19-r1 |
Arch
fixed in all releases since August 2013, discussion here and package info here |
| anything recent |
not vulnerable |
Fedora
discussion |
| 19 and earlier |
vulnerable |
uses glibc 2.17 and earlier |
| 20 |
not vulnerable |
uses glibc 2.18 |
| 21 |
not vulnerable |
uses glibc 2.20 |
Mandriva Linux
|
| all |
vulnerable |
appears to use glibc 2.16 |
openSUSE
vulnerability information |
| Enterprise 11 & older |
vulnerable |
| Enterprise 12 |
not vulnerable |
| openSUSE 13.1 & newer |
not vulnerable |
Slackware
|
| current |
not vulnerable |
uses glibc 2.20 |
| 14.1 and earlier |
vulnerable |
uses glibc 2.17 and earlier
</tr> |
Knoppix
information about glibc versions |
| 7.2 and earlier |
vulnerable |
uses glibc 2.17 and earlier |
| 7.4 and later |
not vulnerable |
uses glibc 2.19 and later |
Slax
|
| all |
vulnerable |
appears to use glibc 2.15 |
CentOS
|
| CentOS-5 |
fix available |
fixed in glibc-2.5-123.el5_11 |
| CentOS-6 |
fix available |
fixed in glibc-2.12-1.149.el6_6.5 |
| CentOS-7 |
fix available |
fixed in glibc-2.17-55.el7_0.5 |
</table>
***
## Patching
iSEC and Matasano recommend performing the following discovery and remediation steps.
### Discovery
First, determine if your Linux is vulnerable. Either consult the [table above](#versions), contact your vendor, or get the version from the version from the library itself. To do the latter, run `locate libc.so.6` to find the location of your libc, then run that file, and it will print out version information.
### Fix
If your distribution has patches available, install those patches. Otherwise:
* Update to glibc 2.18 or newer
* Restart all processes that load the glibc library
* Issue new binaries for software statically linked against a vulnerable version of the glibc library.
## Technical Overview
The [__nss_hostname_digits_dots()](https://sourceware.org/git/?p=glibc.git;a=blobdiff;f=nss/digits_dots.c;h=e007ef47a41b69437655c26565689be393705a82;hp=2b862956e9a8c39bbccbea982add1d7ab2d16ab2;hb=d5dd6189d506068ed11c8bfa1e1e9bffde04decd;hpb=fef94eab0bd308d5059a2588c753bf9a4926845d) function of the GNU C Library (glibc) is vulnerable to a buffer overflow. This function incorrectly calculates the size of a buffer to allocate, and under certain circumstances, arbitrary data can overwrite adjacent memory resulting in a heap based buffer overflow. While only a maximum of four (4) bytes of memory can be overwritten, it has been demonstrated that this was enough to bypass exploitation mitigations (such as ASLR and PIE) and grant code execution. The `__nss_hostname_digits_dots()` function is usually not called directly but is called from the `gethostbyname()` and `gethostbyname2()` glibc functions.
In practice, this can be exploited whenever the hostname passed is long enough (at least 1KB) and passes other sanity checks:
* The hostname is composed entirely of digits and dots
* The hostname starts and ends with a digit
* The hostname must be of the form of `a`, `a.b`, `a.b.c` or `a.b.c.d`
## References
* [CVE-2015-0235](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0235)
* [https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability](https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability)
* [https://www.qualys.com/research/security-advisories/GHOST-CVE-2015-0235.txt](https://www.qualys.com/research/security-advisories/GHOST-CVE-2015-0235.txt)
* [http://ma.ttias.be/critical-glibc-update-cve-2015-0235-gethostbyname-calls/](http://ma.ttias.be/critical-glibc-update-cve-2015-0235-gethostbyname-calls/)
* [http://www.frsag.org/pipermail/frsag/2015-January/005722.html](http://www.frsag.org/pipermail/frsag/2015-January/005722.html)
* [https://sourceware.org/bugzilla/show_bug.cgi?id=15014](https://sourceware.org/bugzilla/show_bug.cgi?id=15014)
* [https://rhn.redhat.com/errata/RHSA-2015-0090.html](https://rhn.redhat.com/errata/RHSA-2015-0090.html)
* [https://launchpad.net/ubuntu/+source/eglibc](https://launchpad.net/ubuntu/+source/eglibc)
* [https://security-tracker.debian.org/tracker/CVE-2015-0235](https://security-tracker.debian.org/tracker/CVE-2015-0235)
