17 comment

1. Linux Sever should be Linux Server

2. The md5sum of the GHOST.c code from the uchicago.edu website that I tested with is

   a19b0657c80d74ea5c4f4544dc9998c5

   You should always check this before compiling downloaded code, otherwise the next exploit on you will be a man in the middle attack.

3. Where’d you hear about ghost.c on uchicago’s webshare?

   1. The code was published in original research page at openwall and now it is everywhere including uchicago’s webshare:
      http://www.openwall.com/lists/oss-security/2015/01/27/9

4. That’s odd, the MD5 I get is d0ed67a61753e568596a830e7171a8eb. Which one of has the right version?

   1. There are probably slightly different versions going around with differing whitespace, etc. I mentioned the uchicago.edu site because its probably more static than the gist URL. Either way, just make sure that you’re downloading something legit.

      1. I would agree with that last sentence. But then, how trustworthy am I? You might try to see if you can reverse the hash I posted.

         Reviewing the code might not be entirely sufficient as the MITM could exclude vulnerable versions but ilthe code could appear safe to run.

   2. Try get MD5 hash of source code file => GHOST.c

5. Single Step:

   # curl -L https://www.cyberciti.biz/files/scripts/GHOST-test.sh.txt | sh -s --
     % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                    Dload  Upload   Total   Spent    Left  Speed
   100  2172  100  2172    0     0   7676      0 --:--:-- --:--:-- --:--:--  7674
   Vulnerable glibc version <= 2.17-54
   Vulnerable glibc version <= 2.5-122
   Vulnerable glibc version <= 2.12-1.148
   Detected glibc version 2.17 revision 55
   Not Vulnerable.

   1. If your concern is security, then don’t pipe shell scripts directly into your shell.

6. $ md5sum GHOST.c
   a19b0657c80d74ea5c4f4544dc9998c5 GHOST.c
   $ md5sum GHOST-test.sh
   bd6fea3404950de06e024e2d8b924219 GHOST-test.sh

   $ ./GHOST
   vulnerable
   $ bash GHOST-test.sh
   Vulnerable glibc version <= 2.17-54
   Vulnerable glibc version <= 2.5-122
   Vulnerable glibc version <= 2.12-1.148
   Detected glibc version 2.12 revision 149
   Not Vulnerable.

   1. The script has been updated.

7. A practical thing (hope it could be helpful for anyone). You don’t need to reboot the whole server after updating. If you are not able to do reboot — use this cmd which relaunchs only several applications that actually use vulnerable glibc:

   for s in $(lsof | grep libc | awk '{print $1}' | sort | uniq); do if [[ -f "/etc/init.d/$s" && "$(ps aufx | grep -v grep | grep $s)" ]]; then echo $s; service $s restart; fi; done

   From.

8. #!/bin/bash
   #GHOST vulnerability detector (DEBIAN & co.)
   libc_main_vers=$(dpkg -l | grep libc6 | awk '{ print $3 }' | awk -F . '{ print $1 }')
   upd=$(dpkg -l | grep libc6| awk '{ print $3 }'| tail -c 2)
   sub=$(dpkg -l | grep libc6| awk '{ print $3 }'| awk -F . '{print$2}' |head -c 2)
   for ver in ${libc_main_vers}; do
       if (( ver = 2  && upd >= 7 && sub >= 12 )); then
           echo not vulnerable
       else
           if ((ver > 2 )); then
                   echo not vulnerable
           else
                   echo "vulnerable to GHOST (CVE-2015-0235)"
           fi
       fi
   done
   exit 0  
   

   This is the script working for Debian (

9. Great write up!

   Are Solaris glib packages vulnerable? Not finding anything online (or from Oracle) about it.

   Thanks!

   -S

10. sorry guys…my server doesnt have rpm package..and i am unable to connect it to any internet connection since it is prohibited. But i still need to check the vulnerability of our system. How can i do it ? thx

11. Method #2: GHOST-test.sh Vulnerability Test Bash Script

    as per the ghost shell script, it says glibc 2.12 is not vulnerable in the screen shot.

    But version in between 2.2 to 2.17 all are vulnerable to GHOST attack. refer link : https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0235

    after referring the NVD, looks like the script is not working properly.

    Have a question? Post it on our forum!