Pretty sure you’ve all seen this, but in case you haven’t. Need to make sure the login nodes are patched for sure, along with nginx, wilbur, gust, collab, xgitlab, jira. I mean, everything needs patching, obviously, but we need to hit the externally exposed machines first. -- Craig On 2/16/16, 4:51 PM, "[email protected] on behalf of Gene Rackow" <[email protected] on behalf of [email protected]> wrote:

For anyone running Linux...

In case you haven't seen it yet... A hole has been found in glibc that allows remote execution of code. It's not easy, but possible. Note that glibc is in every tool on the system, so anything with a network component is vulnerable... ssh, apach, wget, sudo, ...

More likely attempts to exploit this will cause the applications to crash. Please check your patch levels to get this installed ASAP.

=================================================== https://googleonlinesecurity.blogspot.com/2016/02/cve-2015-7547-glibc-getadd...

https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html

Proof of concept: https://github.com/fjserna/CVE-2015-7547

- From the notes...

Our initial investigations showed that the issue affected all the versions of glibc since 2.9. You should definitely update if you are on an older version though. If the vulnerability is detected, machine owners may wish to take steps to mitigate the risk of an attack.

The glibc DNS client side resolver is vulnerable to a stack-based buffer overflow when the getaddrinfo() library function is used. Software using this function may be exploited with attacker-controlled domain names, attacker-controlled DNS servers, or through a man-in-the-middle attack.

The vectors to trigger this buffer overflow are very common and can include ssh, sudo, and curl. We are confident that the exploitation vectors are diverse and widespread; we have not attempted to enumerate these vectors further.

Remote code execution is possible, but not straightforward. It requires bypassing the security mitigations present on the system, such as ASLR.

=================================================== https://googleonlinesecurity.blogspot.com/2016/02/cve-2015-7547-glibc-getadd...

https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html

Proof of concept: https://github.com/fjserna/CVE-2015-7547

- From the notes...

Our initial investigations showed that the issue affected all the versions of glibc since 2.9. You should definitely update if you are on an older version though. If the vulnerability is detected, machine owners may wish to take steps to mitigate the risk of an attack.

The glibc DNS client side resolver is vulnerable to a stack-based buffer overflow when the getaddrinfo() library function is used. Software using this function may be exploited with attacker-controlled domain names, attacker-controlled DNS servers, or through a man-in-the-middle attack.

The vectors to trigger this buffer overflow are very common and can include ssh, sudo, and curl. We are confident that the exploitation vectors are diverse and widespread; we have not attempted to enumerate these vectors further.

Remote code execution is possible, but not straightforward. It requires bypassing the security mitigations present on the system, such as ASLR.

--Gene

--Gene _______________________________________________ cyber911 mailing list [email protected] https://lists.anl.gov/mailman/listinfo/cyber911