老大 1月27日发布的 Linux Glibc库严重安全漏洞修复通知 如何操作啊？
[i=s] 本帖最后由 3g210 于 2015-1-30 17:20 编辑 [/i][font=微软雅黑, Microsoft Yahei, Hiragino Sans GB, tahoma, arial, 宋体][color=#333333][b]老大，1月27日发布的这个 Linux Glibc库严重安全漏洞修复通知 如何操作啊？小白们搞不懂！[/b][/color][/font]
我的操作系统是
CentOS 6.3 64位，谢谢！[color=#333333][font=微软雅黑,]
Linux Glibc库严重安全漏洞修复通知[/font][/color]
[size=2][font=Arial][font=微软雅黑]尊敬的[font=inherit][size=13px]阿里[/size][/font]云[font=inherit][size=13px]ECS[/size][/font]用户：[/font][/font][/size]
[size=2][font=Arial][font=微软雅黑] [/font][/font][/size]
[size=2][font=Arial][font=微软雅黑]您好，日前[font=inherit][size=13px]Linux[/size][/font] GNU glibc标准库的 gethostbyname函数爆出缓冲区溢出漏洞，漏洞编号为CVE-2015-0235。黑客可以通过gethostbyname系列函数实现远程代码执行，获取[font=inherit][size=13px]服务器[/size][/font]的控制权及Shell权限，此漏洞触发途径多，影响范围大，请大家关注和及时临时修复，后续我们会尽快更新镜像修复。请知晓。[/font][/font][/size]
[size=2][font=Arial][font=微软雅黑]
[font=inherit][size=13px][font=inherit]一、 漏洞发布日期[/font][/size][/font]
[font=inherit][size=13px]2015[/size][/font][font=inherit][size=13px]年1月27日 [/size][/font][/font][/font][/size]
[size=2][font=Arial][font=微软雅黑]
[font=inherit][size=13px][font=inherit]二、 已确认被成功利用的软件及[font=inherit]系统[/font][/font][/size][/font]
[font=inherit][size=13px]Glibc 2.2[/size][/font][font=inherit][size=13px]到2.17 (包含2.2和2.17版本) [/size][/font]
[font=inherit][size=13px][font=inherit]三、 漏洞描述[/font][/size][/font]
[font=inherit][size=13px]GNU glibc[/size][/font][font=inherit][size=13px]标准库的gethostbyname 函数爆出缓冲区溢出漏洞，漏洞编号：CVE-2015-0235。 Glibc 是提供系统调用和基本函数的 C 库，比如open, malloc, printf等等。所有动态连接的程序都要用到Glibc。远程攻击者可以利用这个漏洞执行任意代码并提升运行应用程序的用户的权限。 [/size][/font]
[font=inherit][size=13px][font=inherit]四、 漏洞检测方法[/font][/size][/font]
[font=inherit][size=13px]请[font=inherit]自[/font]行检测： [/size][/font]
[font=inherit][size=13px][[test]] [/size][/font]
[font=inherit][size=13px]$ cat > GHOST.c << EOF [/size][/font]
[font=inherit][size=13px]#include <netdb.h> [/size][/font]
[font=inherit][size=13px]#include <stdio.h> [/size][/font]
[font=inherit][size=13px]#include <stdlib.h> [/size][/font]
[font=inherit][size=13px]#include <string.h> [/size][/font]
[font=inherit][size=13px]#include <errno.h> [/size][/font]
[font=inherit][size=13px]#define CANARY"in_the_coal_mine" [/size][/font]
[font=inherit][size=13px]struct { [/size][/font]
[font=inherit][size=13px] char buffer[1024]; [/size][/font]
[font=inherit][size=13px] char canary[sizeof(CANARY)]; [/size][/font]
[font=inherit][size=13px]} temp = { "buffer", CANARY }; [/size][/font]
[font=inherit][size=13px]int main(void) { [/size][/font]
[font=inherit][size=13px] struct hostent resbuf; [/size][/font]
[font=inherit][size=13px] struct hostent *result; [/size][/font]
[font=inherit][size=13px] int herrno; [/size][/font]
[font=inherit][size=13px] int retval; [/size][/font]
[font=inherit][size=13px] /*** strlen (name) = size_needed -sizeof (*host_addr) - sizeof (*h_addr_ptrs) - 1; ***/ [/size][/font]
[font=inherit][size=13px] size_t len = sizeof(temp.buffer) -16*sizeof(unsigned char) - 2*sizeof(char *) - 1; [/size][/font]
[font=inherit][size=13px] char name[sizeof(temp.buffer)]; [/size][/font]
[font=inherit][size=13px] memset(name, '0', len); [/size][/font]
[font=inherit][size=13px] name[len] = '\0'; [/size][/font]
[font=inherit][size=13px] retval = gethostbyname_r(name,&resbuf, temp.buffer, sizeof(temp.buffer), &result, &herrno); [/size][/font]
[font=inherit][size=13px] if (strcmp(temp.canary, CANARY) !=0) { [/size][/font]
[font=inherit][size=13px] puts("vulnerable"); [/size][/font]
[font=inherit][size=13px] exit(EXIT_SUCCESS); [/size][/font]
[font=inherit][size=13px] } [/size][/font]
[font=inherit][size=13px] if (retval == ERANGE) { [/size][/font]
[font=inherit][size=13px] puts("notvulnerable"); [/size][/font]
[font=inherit][size=13px] exit(EXIT_SUCCESS); [/size][/font]
[font=inherit][size=13px] } [/size][/font]
[font=inherit][size=13px] puts("should nothappen"); [/size][/font]
[font=inherit][size=13px] exit(EXIT_FAILURE); [/size][/font]
[font=inherit][size=13px]} [/size][/font]
[font=inherit][size=13px]EOF [/size][/font]
[font=inherit][size=13px][test] [/size][/font]
[font=inherit][size=13px]$ gcc GHOST.c -o GHOST [/size][/font]
[font=inherit][size=13px][test] [/size][/font]
[font=inherit][size=13px]$./GHOST [/size][/font]
[font=inherit][size=13px]vulnerable [/size][/font]
[font=inherit][size=13px][font=inherit]五、 建议修补方案[/font][/size][/font]
[/font][/font][/size]
[font=Arial][size=2][font=微软雅黑] [/font][/size][/font]
[font=Arial][font=微软雅黑][size=3][font=inherit][size=16px][font=inherit]特别提示：由于glibc属于Linux系统基础组件，为了避免修补对您服务器造成影响，建议您选择合适时间进行修复，同时务必在修复前通过快照[font=inherit]操作[/font]进行备份，如果修复出现[font=inherit]问题[/font]，可以迅速回滚快照恢复。[/font][/size][/font][/size][/font][/font]
[size=2][font=Arial][font=微软雅黑]
[/font][/font][/size]
[size=3][font=Arial][font=inherit][size=16px][font=微软雅黑][font=inherit][font=inherit]Centos 5/6/7：[/font][/font][/font][/size][/font][/font][/size]
[size=3][font=Arial][font=inherit][size=16px][font=微软雅黑][font=inherit]
[/font][/font][/size][/font][/font][/size]
[size=2][font=Arial][font=微软雅黑][font=inherit][size=13px]yum update glibc[/size][/font][/font][/font][/size]
[size=2][font=Arial][font=微软雅黑]
[/font][/font][/size]
[size=3][font=Arial][font=inherit][size=16px][font=微软雅黑][font=inherit][font=inherit]Ubuntu 12/14[/font][/font][/font][/size][/font][/font][/size]
[size=2][font=Arial][font=微软雅黑][font=inherit][size=13px]apt-get update[/size][/font][/font][/font][/size]
[size=2][font=Arial][font=微软雅黑][font=inherit][size=13px]apt-get install libc6[/size][/font][/font][/font][/size]
[size=2][font=Arial][font=微软雅黑]
[/font][/font][/size]
[size=3][font=Arial][font=inherit][size=16px][font=微软雅黑][font=inherit][font=inherit]Debian 6[/font][/font][/font][/size][/font][/font][/size]
[size=3][font=Arial][font=inherit][size=16px][font=微软雅黑][font=inherit]
[/font][/font][/size][/font][/font][/size]
[size=2][font=Arial][font=inherit][size=13px][font=微软雅黑]wget -O /etc/apt/sources.list.d/debian6-lts.list [/font][/size][/font][/font][/size][font=Arial][font=微软雅黑][size=2]http://mirrors.aliyun.com/repo/debian6-lts.list
apt-get update
apt-get install libc6[/size]
[/font][/font]
[size=2][font=Arial][font=微软雅黑]
[/font][/font][/size]
[size=3][font=Arial][font=inherit][size=16px][font=微软雅黑][font=inherit][font=inherit]Debian 7[/font][/font][/font][/size][/font][/font][/size]
[size=3][font=Arial][font=inherit][size=16px][font=微软雅黑][font=inherit]
[/font][/font][/size][/font][/font][/size]
[size=2][font=Arial][font=微软雅黑][font=inherit][size=13px]apt-get update[/size][/font][/font][/font][/size]
[size=2][font=Arial][font=微软雅黑][font=inherit][size=13px]apt-get install libc6[/size][/font][/font][/font][/size]
[size=2][font=Arial][font=微软雅黑]
[/font][/font][/size]
[size=3][font=Arial][font=inherit][size=16px][font=微软雅黑][font=inherit][font=inherit]Opensuse 13[/font][/font][/font][/size][/font][/font][/size]
[size=3][font=Arial][font=inherit][size=16px][font=微软雅黑][font=inherit]
[/font][/font][/size][/font][/font][/size]
[size=2][font=Arial][font=微软雅黑][font=inherit][size=13px]zypper refresh[/size][/font][/font][/font][/size]
[size=2][font=Arial][font=微软雅黑][font=inherit][size=13px]zypper update glibc*[/size][/font][/font][/font][/size]
[size=2][font=Arial][font=微软雅黑]
[/font][/font][/size]
[size=3][font=Arial][font=inherit][size=16px][font=微软雅黑][font=inherit][font=inherit]Aliyun linux 5u7[/font][/font][/font][/size][/font][/font][/size]
[size=3][font=Arial][font=inherit][size=16px][font=微软雅黑][font=inherit]
[/font][/font][/size][/font][/font][/size]
[size=2][font=Arial][font=inherit][size=13px][font=微软雅黑]wget -O /etc/yum.repos.d/aliyun-5.repo [/font][/size][/font][font=inherit][size=13px][font=微软雅黑]http://mirrors.aliyun.com/repo/aliyun-5.repo
yum update glibc[/font][/size][/font][/font][/size]
[size=2][font=Arial][font=微软雅黑] [/font][/font][/size]
[font=Arial][size=2][font=微软雅黑]阿里云ECS团队[/font][/size][/font]
[font=Arial][size=2][font=微软雅黑]2014[/font][/size][/font][font=Arial][size=2][font=微软雅黑]年1月29日[/font][/size][font=inherit][font=微软雅黑, sans-serif][/font][/font][/font] 上面这里不是有解决方案了吗? [b]回复 [url=http://www.wdlinux.cn/bbs/redirect.php?goto=findpost&pid=66640&ptid=38053]2#[/url] [i]admin[/i] [/b]
[table=98%]
[tr][td][b]老大请你帮忙看下，我是按[/b][url=http://www.wdlinux.cn/bbs/space.php?uid=25248]cbynd[/url]的[b]以下[/b][size=12px]方法[/size][b]操作的，不知是否成功更新没有？万分感谢！[/b]
[size=3][url=http://www.wdlinux.cn/bbs/space.php?uid=25248]cbynd[/url]你好，我是CentOS 6.3 64位的，现用ssh登陆服务器，按你如下方法操作的，
[font=宋体][b]CentOS 和 RedHat 更新方法如下:
[/b][/font][font=宋体]1）用户使用root用户, 在系统上执行： # [color=red]yum clean all; yum update glibc
[/color][color=#000000]2)[/color][color=#ff0000] [/color]用户使用root用户, 在系统上执行： # [color=#ff0000]y[/color][color=#ff0000]
[/color]3）以上命令执行完成后， 查看[b][color=#FF0000]Glibc[/color][/b]版本：# [color=red]rpm -qa|grep glibc-2.12 （跟右侧对应glibc版本对应的话，说明修复成功）[/color]
[/font][/size][font=宋体][size=3][color=red]
[/color][/size][/font]
[size=3]但是更新后[font=宋体]查看[/font][b][color=#FF0000]Glibc[/color][/b][font=宋体]版本情况好象[/font]与你描述的不一样，[color=#0000ff][b]烦请帮忙看看谢谢！[/b][/color]详见下：[/size]
[size=3][color=red][font=宋体][root@AY140115162727456ea9Z ~]# rpm -qa|grep glibc-2.12
glibc-2.12-1.149.el6_6.5.x86_64
[/font][/color]
[color=red][font=宋体][color=#444444][font=Verdana, Helvetica, Arial, sans-serif]这个是还没有更新前查看显示的代码：[/font][/color][/font][/color]
[color=red][font=宋体][color=#444444][font=Verdana, Helvetica, Arial, sans-serif][root@AY140115162727456ea9Z ~]# rpm -qa|grep glibc-2.12[/font][/color]
[color=#444444][font=Verdana, Helvetica, Arial, sans-serif]glibc-2.12-1.107.el6_4.2.x86_64[/font][/color]
[/font][/color]
[color=red][font=宋体]
[/font][/color]
[color=red][font=宋体][color=#444444][font=Verdana, Helvetica, Arial, sans-serif]从更新前和更新后的代码看，不知究竟更新成功没有？帮忙确认下好吗！[/font][/color][/font][/color]
[color=red][font=宋体][color=#444444][font=Verdana, Helvetica, Arial, sans-serif]以下是在[/font][/color][color=#444444][font=Verdana, Helvetica, Arial, sans-serif]ssh上[/font][/color][color=#444444][font=Verdana, Helvetica, Arial, sans-serif]更新时的完整代码：[/font][/color][/font][/color]
[/size][size=3]
[root@AY140115162727456ea9Z ~]# yum clean all; yum update glibc
Loaded plugins: fastestmirror
Cleaning repos: base extras rpmforge updates
Cleaning up Everything
Cleaning up list of fastest mirrors
Loaded plugins: fastestmirror
Determining fastest mirrors
* base: mirrors.hustunique.com
* extras: mirrors.hustunique.com
* rpmforge: ftp.riken.jp
* updates: mirrors.hustunique.com
base | 3.7 kB 00:00
base/primary_db | 4.6 MB 00:08
extras | 3.4 kB 00:00
extras/primary_db | 30 kB 00:00
rpmforge | 1.9 kB 00:00
http://ftp.riken.jp/pub/Linux/dag/redhat/el5/en/x86_64/rpmforge/repodata/primary.sqlite.bz2: [Errno 12] Timeout on
http://ftp.riken.jp/pub/Linux/dag/redhat/el5/en/x86_64/rpmforge/repodata/primary.sqlite.bz2: (28, 'Operation too slow. Less than 1 bytes/sec transfered the last 30
seconds')
Trying other mirror.
rpmforge/primary_db | 7.0 MB 00:30
updates | 3.4 kB 00:00
updates/primary_db | 2.1 MB 00:03
Setting up Update Process
Resolving Dependencies
--> Running transaction check
---> Package glibc.x86_64 0:2.12-1.107.el6_4.2 will be updated
--> Processing Dependency: glibc = 2.12-1.107.el6_4.2 for package: glibc-devel-2.12-1.107.el6_4.2.x86_64
--> Processing Dependency: glibc = 2.12-1.107.el6_4.2 for package: nscd-2.12-1.107.el6_4.2.x86_64
--> Processing Dependency: glibc = 2.12-1.107.el6_4.2 for package: glibc-common-2.12-1.107.el6_4.2.x86_64
--> Processing Dependency: glibc = 2.12-1.107.el6_4.2 for package: glibc-headers-2.12-1.107.el6_4.2.x86_64
---> Package glibc.x86_64 0:2.12-1.149.el6_6.5 will be an update
--> Running transaction check
---> Package glibc-common.x86_64 0:2.12-1.107.el6_4.2 will be updated
---> Package glibc-common.x86_64 0:2.12-1.149.el6_6.5 will be an update
---> Package glibc-devel.x86_64 0:2.12-1.107.el6_4.2 will be updated
---> Package glibc-devel.x86_64 0:2.12-1.149.el6_6.5 will be an update
---> Package glibc-headers.x86_64 0:2.12-1.107.el6_4.2 will be updated
---> Package glibc-headers.x86_64 0:2.12-1.149.el6_6.5 will be an update
---> Package nscd.x86_64 0:2.12-1.107.el6_4.2 will be updated
---> Package nscd.x86_64 0:2.12-1.149.el6_6.5 will be an update
--> Finished Dependency Resolution
Dependencies Resolved
================================================================================
Package Arch Version Repository Size
================================================================================
Updating:
glibc x86_64 2.12-1.149.el6_6.5 updates 3.8 M
Updating for dependencies:
glibc-common x86_64 2.12-1.149.el6_6.5 updates 14 M
glibc-devel x86_64 2.12-1.149.el6_6.5 updates 983 k
glibc-headers x86_64 2.12-1.149.el6_6.5 updates 612 k
nscd x86_64 2.12-1.149.el6_6.5 updates 223 k
Transaction Summary
================================================================================
Upgrade 5 Package(s)
Total download size: 20 M
Is this ok [y/N]: y
Downloading Packages:
(1/5): glibc-2.12-1.149.el6_6.5.x86_64.rpm | 3.8 MB 00:05
(2/5): glibc-common-2.12-1.149.el6_6.5.x86_64.rpm | 14 MB 00:25
(3/5): glibc-devel-2.12-1.149.el6_6.5.x86_64.rpm | 983 kB 00:01
(4/5): glibc-headers-2.12-1.149.el6_6.5.x86_64.rpm | 612 kB 00:01
(5/5): nscd-2.12-1.149.el6_6.5.x86_64.rpm | 223 kB 00:00
--------------------------------------------------------------------------------
Total 589 kB/s | 20 MB 00:34
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
Updating : glibc-2.12-1.149.el6_6.5.x86_64 1/10
Updating : glibc-common-2.12-1.149.el6_6.5.x86_64 2/10
Updating : glibc-headers-2.12-1.149.el6_6.5.x86_64 3/10
Updating : glibc-devel-2.12-1.149.el6_6.5.x86_64 4/10
Updating : nscd-2.12-1.149.el6_6.5.x86_64 5/10
warning: /etc/nscd.conf created as /etc/nscd.conf.rpmnew
Cleanup : glibc-devel-2.12-1.107.el6_4.2.x86_64 6/10
Cleanup : glibc-headers-2.12-1.107.el6_4.2.x86_64 7/10
Cleanup : nscd-2.12-1.107.el6_4.2.x86_64 8/10
Cleanup : glibc-common-2.12-1.107.el6_4.2.x86_64 9/10
Cleanup : glibc-2.12-1.107.el6_4.2.x86_64 10/10
Verifying : nscd-2.12-1.149.el6_6.5.x86_64 1/10
Verifying : glibc-common-2.12-1.149.el6_6.5.x86_64 2/10
Verifying : glibc-devel-2.12-1.149.el6_6.5.x86_64 3/10
Verifying : glibc-headers-2.12-1.149.el6_6.5.x86_64 4/10
Verifying : glibc-2.12-1.149.el6_6.5.x86_64 5/10
Verifying : glibc-2.12-1.107.el6_4.2.x86_64 6/10
Verifying : nscd-2.12-1.107.el6_4.2.x86_64 7/10
Verifying : glibc-devel-2.12-1.107.el6_4.2.x86_64 8/10
Verifying : glibc-headers-2.12-1.107.el6_4.2.x86_64 9/10
Verifying : glibc-common-2.12-1.107.el6_4.2.x86_64 10/10
Updated:
glibc.x86_64 0:2.12-1.149.el6_6.5
Dependency Updated:
glibc-common.x86_64 0:2.12-1.149.el6_6.5
glibc-devel.x86_64 0:2.12-1.149.el6_6.5
glibc-headers.x86_64 0:2.12-1.149.el6_6.5
nscd.x86_64 0:2.12-1.149.el6_6.5
Complete!
[root@AY140115162727456ea9Z ~]# rpm -qa|grep glibc-2.12
glibc-2.12-1.149.el6_6.5.x86_64
[root@AY140115162727456ea9Z ~]#
[/size][/td][/tr]
[/table]
页:
[1]