WDlinux官方论坛 - Powered by Discuz! Board

标题: [求助] 老大 1月27日发布的 Linux Glibc库严重安全漏洞修复通知如何操作啊？ [打印本页]

作者: 3g210 时间: 2015-1-30 17:17 标题: 老大 1月27日发布的 Linux Glibc库严重安全漏洞修复通知如何操作啊？

本帖最后由 3g210 于 2015-1-30 17:20 编辑

老大，1月27日发布的这个 Linux Glibc库严重安全漏洞修复通知如何操作啊？小白们搞不懂！
我的操作系统是
CentOS 6.3 64位，谢谢！

Linux Glibc库严重安全漏洞修复通知

尊敬的阿里云ECS用户：

您好，日前Linux GNU glibc标准库的 gethostbyname函数爆出缓冲区溢出漏洞，漏洞编号为CVE-2015-0235。黑客可以通过gethostbyname系列函数实现远程代码执行，获取服务器的控制权及Shell权限，此漏洞触发途径多，影响范围大，请大家关注和及时临时修复，后续我们会尽快更新镜像修复。请知晓。

一、漏洞发布日期

2015年1月27日

二、已确认被成功利用的软件及系统

Glibc 2.2到2.17 (包含2.2和2.17版本)

三、漏洞描述

GNU glibc标准库的gethostbyname 函数爆出缓冲区溢出漏洞，漏洞编号：CVE-2015-0235。 Glibc 是提供系统调用和基本函数的 C 库，比如open, malloc, printf等等。所有动态连接的程序都要用到Glibc。远程攻击者可以利用这个漏洞执行任意代码并提升运行应用程序的用户的权限。

四、漏洞检测方法

请自行检测：
[[test]]
$ cat > GHOST.c << EOF
#include <netdb.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#define CANARY"in_the_coal_mine"
struct {
  char buffer[1024];
  char canary[sizeof(CANARY)];
} temp = { "buffer", CANARY };
int main(void) {
  struct hostent resbuf;
  struct hostent *result;
  int herrno;
  int retval;
  /*** strlen (name) = size_needed -sizeof (*host_addr) - sizeof (*h_addr_ptrs) - 1; ***/
  size_t len = sizeof(temp.buffer) -16*sizeof(unsigned char) - 2*sizeof(char *) - 1;
  char name[sizeof(temp.buffer)];
  memset(name, '0', len);
  name[len] = '\0';
  retval = gethostbyname_r(name,&resbuf, temp.buffer, sizeof(temp.buffer), &result, &herrno);
  if (strcmp(temp.canary, CANARY) !=0) {
puts("vulnerable");
exit(EXIT_SUCCESS);
  }
  if (retval == ERANGE) {
puts("notvulnerable");
exit(EXIT_SUCCESS);
  }
  puts("should nothappen");
  exit(EXIT_FAILURE);
}
EOF
[test]
$ gcc GHOST.c -o GHOST
[test]
$./GHOST
vulnerable

五、建议修补方案

特别提示：由于glibc属于Linux系统基础组件，为了避免修补对您服务器造成影响，建议您选择合适时间进行修复，同时务必在修复前通过快照操作进行备份，如果修复出现问题，可以迅速回滚快照恢复。

Centos 5/6/7：

yum update glibc

Ubuntu 12/14

apt-get update

apt-get install libc6

Debian 6

wget -O /etc/apt/sources.list.d/debian6-lts.list http://mirrors.aliyun.com/repo/debian6-lts.list
apt-get update
apt-get install libc6

Debian 7

apt-get update

apt-get install libc6

Opensuse 13

zypper refresh

zypper update glibc*

Aliyun linux 5u7

wget -O /etc/yum.repos.d/aliyun-5.repo http://mirrors.aliyun.com/repo/aliyun-5.repo
yum update glibc

阿里云ECS团队

2014年1月29日

作者: admin 时间: 2015-1-30 17:34

上面这里不是有解决方案了吗?

作者: 3g210 时间: 2015-1-30 19:44

回复 2# admin

老大请你帮忙看下，我是按cbynd的以下方法操作的，不知是否成功更新没有？万分感谢！

cbynd你好，我是CentOS 6.3 64位的，现用ssh登陆服务器，按你如下方法操作的，
CentOS 和 RedHat  更新方法如下:
1）用户使用root用户, 在系统上执行： # yum clean all; yum update glibc
2) 用户使用root用户, 在系统上执行： # y
3）以上命令执行完成后，查看Glibc版本：# rpm -qa|grep glibc-2.12 （跟右侧对应glibc版本对应的话，说明修复成功）

但是更新后查看Glibc版本情况好象与你描述的不一样，烦请帮忙看看谢谢！详见下：
[root@AY140115162727456ea9Z ~]# rpm -qa|grep glibc-2.12
glibc-2.12-1.149.el6_6.5.x86_64

这个是还没有更新前查看显示的代码：
[root@AY140115162727456ea9Z ~]# rpm -qa|grep glibc-2.12
glibc-2.12-1.107.el6_4.2.x86_64

从更新前和更新后的代码看，不知究竟更新成功没有？帮忙确认下好吗！
以下是在ssh上更新时的完整代码：

[root@AY140115162727456ea9Z ~]# yum clean all; yum update glibc
Loaded plugins: fastestmirror
Cleaning repos: base extras rpmforge updates
Cleaning up Everything
Cleaning up list of fastest mirrors
Loaded plugins: fastestmirror
Determining fastest mirrors
* base: mirrors.hustunique.com
* extras: mirrors.hustunique.com
* rpmforge: ftp.riken.jp
* updates: mirrors.hustunique.com
base                                                    | 3.7 kB    00:00
base/primary_db                                        | 4.6 MB    00:08
extras                                                 | 3.4 kB    00:00
extras/primary_db                                     |  30 kB    00:00
rpmforge                                              | 1.9 kB    00:00
http://ftp.riken.jp/pub/Linux/dag/redhat/el5/en/x86_64/rpmforge/repodata/primary.sqlite.bz2: [Errno 12] Timeout on

http://ftp.riken.jp/pub/Linux/dag/redhat/el5/en/x86_64/rpmforge/repodata/primary.sqlite.bz2: (28, 'Operation too slow. Less than 1 bytes/sec transfered the last 30

seconds')
Trying other mirror.
rpmforge/primary_db                                     | 7.0 MB    00:30
updates                                                 | 3.4 kB    00:00
updates/primary_db                                     | 2.1 MB    00:03
Setting up Update Process
Resolving Dependencies
--> Running transaction check
---> Package glibc.x86_64 0:2.12-1.107.el6_4.2 will be updated
--> Processing Dependency: glibc = 2.12-1.107.el6_4.2 for package: glibc-devel-2.12-1.107.el6_4.2.x86_64
--> Processing Dependency: glibc = 2.12-1.107.el6_4.2 for package: nscd-2.12-1.107.el6_4.2.x86_64
--> Processing Dependency: glibc = 2.12-1.107.el6_4.2 for package: glibc-common-2.12-1.107.el6_4.2.x86_64
--> Processing Dependency: glibc = 2.12-1.107.el6_4.2 for package: glibc-headers-2.12-1.107.el6_4.2.x86_64
---> Package glibc.x86_64 0:2.12-1.149.el6_6.5 will be an update
--> Running transaction check
---> Package glibc-common.x86_64 0:2.12-1.107.el6_4.2 will be updated
---> Package glibc-common.x86_64 0:2.12-1.149.el6_6.5 will be an update
---> Package glibc-devel.x86_64 0:2.12-1.107.el6_4.2 will be updated
---> Package glibc-devel.x86_64 0:2.12-1.149.el6_6.5 will be an update
---> Package glibc-headers.x86_64 0:2.12-1.107.el6_4.2 will be updated
---> Package glibc-headers.x86_64 0:2.12-1.149.el6_6.5 will be an update
---> Package nscd.x86_64 0:2.12-1.107.el6_4.2 will be updated
---> Package nscd.x86_64 0:2.12-1.149.el6_6.5 will be an update
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
Package          Arch       Version                Repository    Size
================================================================================
Updating:
glibc             x86_64    2.12-1.149.el6_6.5       updates    3.8 M
Updating for dependencies:
glibc-common       x86_64    2.12-1.149.el6_6.5       updates       14 M
glibc-devel       x86_64    2.12-1.149.el6_6.5       updates    983 k
glibc-headers    x86_64    2.12-1.149.el6_6.5       updates    612 k
nscd             x86_64    2.12-1.149.el6_6.5       updates    223 k

Transaction Summary
================================================================================
Upgrade    5 Package(s)

Total download size: 20 M
Is this ok [y/N]: y
Downloading Packages:
(1/5): glibc-2.12-1.149.el6_6.5.x86_64.rpm             | 3.8 MB    00:05
(2/5): glibc-common-2.12-1.149.el6_6.5.x86_64.rpm       |  14 MB    00:25
(3/5): glibc-devel-2.12-1.149.el6_6.5.x86_64.rpm       | 983 kB    00:01
(4/5): glibc-headers-2.12-1.149.el6_6.5.x86_64.rpm    | 612 kB    00:01
(5/5): nscd-2.12-1.149.el6_6.5.x86_64.rpm             | 223 kB    00:00
--------------------------------------------------------------------------------
Total                                        589 kB/s |  20 MB    00:34
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Updating : glibc-2.12-1.149.el6_6.5.x86_64                            1/10
  Updating : glibc-common-2.12-1.149.el6_6.5.x86_64                   2/10
  Updating : glibc-headers-2.12-1.149.el6_6.5.x86_64                   3/10
  Updating : glibc-devel-2.12-1.149.el6_6.5.x86_64                      4/10
  Updating : nscd-2.12-1.149.el6_6.5.x86_64                            5/10
warning: /etc/nscd.conf created as /etc/nscd.conf.rpmnew
  Cleanup : glibc-devel-2.12-1.107.el6_4.2.x86_64                      6/10
  Cleanup : glibc-headers-2.12-1.107.el6_4.2.x86_64                   7/10
  Cleanup : nscd-2.12-1.107.el6_4.2.x86_64                            8/10
  Cleanup : glibc-common-2.12-1.107.el6_4.2.x86_64                   9/10
  Cleanup : glibc-2.12-1.107.el6_4.2.x86_64                         10/10
  Verifying  : nscd-2.12-1.149.el6_6.5.x86_64                            1/10
  Verifying  : glibc-common-2.12-1.149.el6_6.5.x86_64                   2/10
  Verifying  : glibc-devel-2.12-1.149.el6_6.5.x86_64                      3/10
  Verifying  : glibc-headers-2.12-1.149.el6_6.5.x86_64                   4/10
  Verifying  : glibc-2.12-1.149.el6_6.5.x86_64                            5/10
  Verifying  : glibc-2.12-1.107.el6_4.2.x86_64                            6/10
  Verifying  : nscd-2.12-1.107.el6_4.2.x86_64                            7/10
  Verifying  : glibc-devel-2.12-1.107.el6_4.2.x86_64                      8/10
  Verifying  : glibc-headers-2.12-1.107.el6_4.2.x86_64                   9/10
  Verifying  : glibc-common-2.12-1.107.el6_4.2.x86_64                   10/10

Updated:
  glibc.x86_64 0:2.12-1.149.el6_6.5

Dependency Updated:
  glibc-common.x86_64 0:2.12-1.149.el6_6.5
  glibc-devel.x86_64 0:2.12-1.149.el6_6.5
  glibc-headers.x86_64 0:2.12-1.149.el6_6.5
  nscd.x86_64 0:2.12-1.149.el6_6.5

Complete!
[root@AY140115162727456ea9Z ~]# rpm -qa|grep glibc-2.12
glibc-2.12-1.149.el6_6.5.x86_64
[root@AY140115162727456ea9Z ~]#

欢迎光临 WDlinux官方论坛 (http://wdlinux.cn/bbs/)