CVE-2015-7547: glibc getaddrinfo stack-based buffer overflow
Welp, this sucks donkey balls.
https://googleonlinesecurity.blogspot.com/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html
bugreport: https://sourceware.org/bugzilla/show_bug.cgi?id=18665
“The vulnerability relies on an oversized (2048+ bytes) UDP or TCP response, which is followed by another response that will overwrite the stack,” Serna said. “Our suggested mitigation is to limit the response (i.e., via DNSMasq or similar programs) sizes accepted by the DNS resolver locally as well as to ensure that DNS queries are sent only to DNS servers which limit the response size for UDP responses with the truncation bit set.”
Google said that a number of exploitation vectors can be used to attack this vulnerability, including but not limited to ssh, sudo and curl.
“Remote code execution is possible, but not straightforward,” Serna said. “It requires bypassing the security mitigations present on the system, such as ASLR.”
- See more at: https://threatpost.com/critical-glibc-vulnerability-puts-all-linux-machines-at-risk/116261/#sthash.vI4xMr17.dpuf
TLDR: It seems that blocking DNS resolver responses inbound to packet sizes of 1024 should help mitigate the issue until patches can be rolled out for the millions upon millions of platforms (including android) that seem to be effected by this bug.
Please check the sources for more detailed info. Just wanted to put this out there for others who may not have seen it. Seems pretty widespread and quite serious. Happy Taco Tuesday!
Posted Feb 16, 2016, 8:44 PM UTC · edited
This is no bueno :(
Have fun patching everyone (at updates are out for open source operating systems)
Seems to have hit android too :/
how did it hit android? android uses bionic (which uses most of openbsd's libc), not glibc.
Good catch. Also reported here: "One Linux-based package that's not vulnerable is Google's Android mobile operating system. It uses a glibc substitute known as Bionic and isn't susceptible, a company representative said." From: http://arstechnica.com/security/2016/02/extremely-severe-bug-leaves-dizzying-number-of-apps-and-devices-vulnerable/
What sucks is that every other site reporting this are saying Android is vulnerable. Sources: http://www.infoworld.com/article/3033862/security/patch-now-unix-bug-puts-linux-android-and-ios-systems-at-risk.html (and others)
There is this one: https://isc.sans.edu/diary/CVE-2015-7547%3A+Critical+Vulnerability+in+glibc+getaddrinfo/20737
Mentioning it's possible for certain apps on android and IOS to be using glibc, but mention it's not on the devices by default.
TLDR: tech media is stupid (but not confirmed until reported by netcraft)
RIP all those ghetto android phones people own on Straight Talk :(
RIP Carriers not pushing out updates/patches properly, even on new phones. sigh
You can partial put the blame on Google allowing carriers/manufactures to do as these please when it comes to the Android ecosystem.
Either way in the end the customer is the one that loses
RIP Google themselves for no longer pushing out updates/patches for their very own Nexus 4/9.