0

How do I determine the programs that are installed on my system which could be vulnerable to glibc's ghost bug? (Presuming the system has a vulnerable version of the libc6 library).

Posts like How To Patch and Protect Linux Server Against the Glibc GHOST Vulnerability # CVE-2015-0235 are helpful, but lsof may not be the best way to test for it.

8
  • 1
    Almost all programs use libc, although they don't necessarily use the vulnerable function gethostbyname(). – Barmar Jan 28 '15 at 21:44
  • @Barmar - yes, agreed. But I'm only interested in what is installed and vulnerable. – jww Jan 28 '15 at 22:33
  • So you want all the programs that use the vulnerable libc, or that use the broken function? – Barmar Jan 28 '15 at 22:45
  • 1
    A program could be vulnerable indirectly. It might use some other library that in turn uses gethostbyname. What's the point of this exercise? – Barmar Jan 28 '15 at 22:46
  • 1
    The vulnerable function is the one that translates hostnames to IP addresses, so most programs that deal with the network use it. But they're only really vulnerable if they get the hostnames from untrusted sources. This is not something that can be determined by scanning the system, you need to understand the nature of each application. – Barmar Jan 28 '15 at 23:01
1

Well, there's more that one way to skin a cat. Below is how I skinned it.

#! /bin/sh

EXE_DIRECTORIES="/bin /sbin /usr/bin /usr/local/bin"
SO_DIRECTORIES="/lib /lib64 /usr/local/lib"
FILES=
VULNERABLE=

echo "Generating file list..."
for d in $EXE_DIRECTORIES ; do

    TEMP=`find "$d" -type f -executable -exec file -i '{}' \; | grep 'x-executable; charset=binary' | cut -f 1 -d:`

    for t in "$TEMP" ; do   
        FILES="$FILES $t"
    done
done

for d in $SO_DIRECTORIES ; do

    TEMP=`find "$d" -type f -executable -exec file -i '{}' \; | grep 'x-executable; charset=binary' | cut -f 1 -d:`

    for t in "$TEMP" ; do   
        FILES="$FILES $t"
    done
done

echo "Testing executables..."
for f in $FILES ; do
    COUNT=`nm -D "$f" 2>/dev/null | grep gethostbyname | grep -c -w U`
    if [ "$COUNT" -ne 0 ]; then
      VULNERABLE="$VULNERABLE $f"
    fi
done

COUNT1=`echo "$FILES" | wc -l`
COUNT2=`echo "$VULNERABLE" | grep -o " " | wc -l`
if [ "$COUNT2" -ne 0 ]; then
  COUNT2=$(( $COUNT2 + 1 ))
fi

echo "Examined components: $COUNT1"
echo "Vulnerable components: $COUNT2"
echo "*****************************"
for v in $VULNERABLE ; do
    echo "$v"
done

On a typical Ubuntu 14 development system, here's what I am getting:

$ ./glibc-check.sh
Generating file list...
Testing executables...
Examined components: 961
Vulnerable components: 32
*****************************
/bin/ss
/bin/hostname
/bin/tar
/bin/cpio
/bin/netstat
/bin/ping
/bin/mt-gnu
/sbin/agetty
/sbin/route
/sbin/rarp
/sbin/ifconfig
/sbin/getty
/usr/bin/logger
/usr/bin/git-upload-pack
/usr/bin/aseqnet
/usr/bin/git
/usr/bin/telnet.netkit
/usr/bin/getent
/usr/bin/mtr
/usr/bin/mtools
/usr/bin/gethostip
/usr/bin/gdb
/usr/bin/tracepath
/usr/bin/python3.4m
/usr/bin/python2.7
/usr/bin/arping
/usr/bin/python3.4
/usr/bin/traceroute6.iputils
/usr/bin/openssl
/usr/bin/git-shell
/usr/bin/rsync

But its only a subset of the 19000+ packages that depend on libc6 (its only the installed packages; and its only components in well known locations):

$ apt-cache rdepends libc6 | wc -l
19125

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.