'GHOST' bug in Linux library enables remote takeover of victim's system

[osx]

‘GHOST’ bug in Linux library enables remote takeover of victim’s system

Researchers with security firm Qualys have identified a buffer overflow vulnerability in the Linux GNU C Library (glibc) that, if exploited, could enable an attacker to remotely take complete control of a victim’s system – all without having knowledge of system credentials.

Qualys considers the vulnerability – CVE-2015-0235, named ‘GHOST’ because it can be triggered by the ‘GetHOST’ functions – to be high in severity, Amol Sarwate, director of engineering with Qualys, told SCMagazine.com in a Wednesday email correspondence.

“In our tests we were able to get a shell remotely, which may allow attackers to steal files, delete programs, install malware or simply perform any other tasks that a user with valid credentials can perform,” Sarwate said.

Debian 7 (Wheezy), Red Hat Enterprise Linux 6 and 7, CentOS 6 and 7, and Ubuntu 12.04 are among the systems that are affected, Sarwate said, adding that other Linux systems using versions of glibc from 2.2 to before 2.18 are also at risk.

The best way to protect against GHOST is to apply patches from Linux distribution vendors, Sarwate said, explaining that Qualys coordinated the disclosure of the bug with the Linux distribution vendors so that patches are already available.

Sarwate said he does not believe that the GHOST vulnerability has been exploited, although he noted that there is no way to know for sure if individuals are working towards it. He also indicated that a determined and skilled attacker should be able to create an exploit, even if it is not that easy.

As indicated in a Tuesday post, Qualys is not yet releasing an exploit, but Sarwate shared some information regarding the proof-of-concept developed during testing.

“After [we] identified the buffer overflow (__nss_hostname_digits_dots() function), we went about how this issue can be exploited remotely,” Sarwate said. “We quickly found that the overflow can be exploited by calling the gethostbyname*() functions. After that the only task remaining was to find a program to which we can send data and which will call the affected functions.

Sarwate went on to say, “For this attack to be successful, the attacker should be able to send data to a program which calls the affected functions. We were able to achieve this by sending a specially crafted mail to a mail server, which allowed us to take control of the mail server.”

In a statement emailed to SCMagazine.com on Tuesday, HD Moore, chief research officer with Rapid7, indicated that exploiting the vulnerability is not likely to be simple, but that an “easily-exploitable case” was discovered in the Exim mail server.

http://www.scmagazine.com/buffer-ov...paign=Feed:+SCMagazineNews+(SC+Magazine+News)

 

[osx]

Critical GHOST vulnerability affects most Linux Systems

A highly critical vulnerability has been unearthed in the GNU C Library (glibc), a widely used component of most Linux distributions, that could allow attackers to execute malicious code on servers and remotely gain control of Linux machines.
The vulnerability, dubbed “GHOST” and assigned CVE-2015-0235, was discovered and disclosed by the security researchers from Redwood Shores, California-based security firm Qualys on Tuesday.
CRITICAL AS HEARTBLEED AND SHELLSHOCK
GHOST is considered to be critical because hackers could exploit it to silently gain complete control of a targeted Linux system without having any prior knowledge of system credentials (i.e. administrative passwords).
The flaw represents an immense Internet threat, in some ways similar to the Heartbleed[/URL],[/B] Shellshock and Poodle bugs that came to light last year.

WHY GHOST ?
The vulnerability in the GNU C Library (glibc) is dubbed GHOST because it can be triggered by the library’s gethostbyname family of functions. Glibc is a repository of open-source software written in the C and C++ coding languages that defines system calls.
The problem actual originates from a heap-based buffer overflow found in the __nss_hostname_digits_dots() function in glibc. This function is especially invoked by the _gethostbyname and gethostbyname2() function calls.
According to the researchers, a remote attacker has ability to call either of these functions which could allow them to exploit the vulnerability in an effort to execute arbitrary code with the permissions of the user running the application.

EXPLOIT CODE
In an attempt to highlight the severity of the risk, security researchers were able to write proof-of-concept exploit code that is capable to carry out a full-fledged remote code execution attack against the Exim mail server.
The researcher’s exploit able to bypass all existing exploit protections (like ASLR, PIE and NX) available on both 32-bit and 64-bit systems, including position independent executions, address space layout randomization and no execute protections.
Using the exploit, an attacker is able to craft malicious emails that could automatically compromise a vulnerable server without the email even being opened, according to Amol Sarwate, director of engineering with Qualys.
So far, the company has not published the exploit code to the public but eventually it plans to make the exploit available as a Metasploit module.

VERSIONS AFFECTED
The vulnerability affects versions of glibc as far back as glibc-2.2, which was released in 2000.
“Unfortunately, it was not recognized as a security threat; as a result, most stable and long-term-support distributions were left exposed (and still are): Debian 7 (wheezy), Red Hat Enterprise Linux 6 & 7, CentOS 6 & 7, Ubuntu 12.04, for example,” researchers from Qualys said in an advisory published Tuesday.

FIXES AVAILABLE FOR SOME LINUX DISTRIBUTIONS
However, major distributors of the Linux operating system, including Red Hat, Debian and Ubuntu, updated their software on Tuesday to thwart the serious cyber threat. In order to update systems, core functions or the entire affected server reboot is required.
Red Hat, the No. 1 provider of Linux software to businesses, recommends its customers to update their systems “as soon as possible to mitigate any potential risk.”

[URL]http://thehackernews.com/2015/01/ghost-linux-security-vulnerability27.html