CVE-2015-0235 PoC — GNU glibc 基于堆的缓冲区错误漏洞

Source

https://github.com/mikesplain/CVE-2015-0235-cookbook

Associated Vulnerability

Title:GNU glibc 基于堆的缓冲区错误漏洞 (CVE-2015-0235)
Description:GNU glibc（又名GNU C Library，libc6）是一种按照LGPL许可协议发布的开源免费的C语言编译程序。 GNU glibc 2.2版本和2.18之前2.x版本中的‘__nss_hostname_digits_dots’函数存在基于堆的缓冲区溢出漏洞。本地和远程攻击者都可通过调用‘ gethostbyname*()’函数利用该漏洞以运行应用程序的用户权限执行任意代码，控制系统。

Description

A chef cookbook to test the GHOST vulnerability

Readme

# CVE-2015-0235-cookbook

[![Circle CI](https://circleci.com/gh/mikesplain/CVE-2015-0235-cookbook.svg?style=svg)](https://circleci.com/gh/mikesplain/CVE-2015-0235-cookbook)
[![Dependency Status](https://gemnasium.com/mikesplain/CVE-2015-0235-cookbook.svg)](https://gemnasium.com/mikesplain/CVE-2015-0235-cookbook)


This cookbook will test if you are vulnerable to [CVE-2015-0235](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0235).  

Current behavior will error out when test fails:
```
bash 'test vulnerability against libc' do
  cwd Chef::Config[:file_cache_path]
  code <<-EOH
    ./CVE-2015-0235
    EOH
  returns [1]
end
```


For debian based systems: [CVE-2015-0235](https://security-tracker.debian.org/tracker/CVE-2015-0235)

For Rhel based systems: [CVE-2015-0235](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-0235)


## Supported Platforms

- Debian / Ubuntu
- Centos / Rhel

## Todo
- [ ] Add Test for currently running processes still using old version (easy in debian with checkrestart -v)
- [ ] Add a script to help with fixing?


## Usage

### CVE-2015-0235::default

Include `CVE-2015-0235` in your node's `run_list`:

```json
{
  "run_list": [
    "recipe[CVE-2015-0235]"
  ]
}
```

## License and Authors

Author:: Mike Splain (<mike.splain@gmail.com>)

File Snapshot


 [4.0K]  /data/pocs/f9f889e77f21ed6a808b3af82c0d7cc8fbc48c59
├── [  47]  Berksfile
├── [  42]  CHANGELOG.md
├── [ 960]  chefignore
├── [ 806]  circle.yml
├── [4.0K]  files
│   └── [4.0K]  default
│       └── [ 973]  ghosttest.c
├── [ 184]  Gemfile
├── [  72]  LICENSE
├── [ 261]  metadata.rb
├── [ 448]  Rakefile
├── [1.3K]  README.md
├── [4.0K]  recipes
│   └── [ 775]  default.rb
└── [ 241]  Thorfile

3 directories, 12 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!