4 ms·

my system (linux mint, based on ubuntu 14.04.1) might be affected. the versions match, the files are there. i'm loath to download and execute the test file tho

by stefs 10y ago

my system (linux mint, based on ubuntu 14.04.1) might be affected. the versions match, the files are there. i'm loath to download and execute the test file though. while i'm almost completely sure this post is legit, i also don't want to delete the gstreamer-0.1 in case it trashes something important. think of trolls recommending the deletion of system32 to speed up the system and free disk space. can i remove this safely? is there more information from another credible source?

spikengineer 10y ago
Just remove the libgstnsf.so file which will not break gstreamer. sudo rm /usr/lib/x86_64-linux-gnu/gstreamer-0.10/libgstnsf.so
skykooler 10y ago
The test file, if your system is affected, will only open a calculator. (if you are concerned whether it has been modified to an actual attack file, you can compare it to the one on the page in a hex editor.) Don't delete gstreamer-0.10, because many things rely on it. It is however safe to delete libgstnsf.so.
- scarybeast 10y ago
  It will likely only open a calculator if you run it against the exact version of everything listed in the blog post, which is Ubuntu 12.04.5 without any further patches. Any different version of Ubuntu (such as 14.04.anything), will have a different glibc binary. Among other issues, the exploit has a hard coded offset of the delta between the memset() and system() functions inside glibc. This offset will only be valid against the glibc binary for 12.04.5. With more work, the exploit could be modified to dynamically calculate the correct offset for almost any version of glibc. If the offset is invalid, you're likely to still get a crash, just no calculator. So the presence of a crash or not can be used to determine trouble vs. ok. That said, Ubuntu 14.04 isn't too badly affected. It does come with gstreamer-0.10, but it does not appear to be used for much. As far as I could tell, gstreamer-1.0 is used for the most important stuff (totem, totem-video-thumbnailer, etc.).
paulv 10y ago
Chris Evans is a credible source. He's the author of vsftpd and worked (works?) for Google on project zero.
- alanh 10y ago
  But what if Chris Evans’ blog account were compromised after Chris Evans decided he was in the mood for some chiptunes? ;-)
chipaca 10y ago
I'd suggest removing gstreamer0.10-plugins-bad
- sn 10y ago
  I removed gstreamer0.10-plugins-bad gstreamer0.10-plugins-bad-multiverse gstreamer1.0-plugins-bad gstreamer1.0-plugins-bad-faad gstreamer1.0-plugins-bad-videoparsers libgstreamer-plugins-bad0.10-0 libgstreamer-plugins-bad1.0-0
swolchok 10y ago
As a cheap extra layer of protection, you could install the version of Linux Mint you've got installed on your real machine in a VM and then run the exploit in the VM. You could also do it from a VirtualBox installation on EC2 to get extra security: if things go south (or as a matter of good hygiene), you can disable the EC2 instance from the EC2 dashboard after you're done.

by stefs 10y ago

spikengineer 10y ago

Just remove the libgstnsf.so file which will not break gstreamer. sudo rm /usr/lib/x86_64-linux-gnu/gstreamer-0.10/libgstnsf.so

skykooler 10y ago

The test file, if your system is affected, will only open a calculator. (if you are concerned whether it has been modified to an actual attack file, you can compare it to the one on the page in a hex editor.) Don't delete gstreamer-0.10, because many things rely on it. It is however safe to delete libgstnsf.so.

scarybeast 10y ago
It will likely only open a calculator if you run it against the exact version of everything listed in the blog post, which is Ubuntu 12.04.5 without any further patches. Any different version of Ubuntu (such as 14.04.anything), will have a different glibc binary. Among other issues, the exploit has a hard coded offset of the delta between the memset() and system() functions inside glibc. This offset will only be valid against the glibc binary for 12.04.5. With more work, the exploit could be modified to dynamically calculate the correct offset for almost any version of glibc. If the offset is invalid, you're likely to still get a crash, just no calculator. So the presence of a crash or not can be used to determine trouble vs. ok. That said, Ubuntu 14.04 isn't too badly affected. It does come with gstreamer-0.10, but it does not appear to be used for much. As far as I could tell, gstreamer-1.0 is used for the most important stuff (totem, totem-video-thumbnailer, etc.).

paulv 10y ago

Chris Evans is a credible source. He's the author of vsftpd and worked (works?) for Google on project zero.

alanh 10y ago
But what if Chris Evans’ blog account were compromised after Chris Evans decided he was in the mood for some chiptunes? ;-)

chipaca 10y ago

I'd suggest removing gstreamer0.10-plugins-bad

sn 10y ago
I removed gstreamer0.10-plugins-bad gstreamer0.10-plugins-bad-multiverse gstreamer1.0-plugins-bad gstreamer1.0-plugins-bad-faad gstreamer1.0-plugins-bad-videoparsers libgstreamer-plugins-bad0.10-0 libgstreamer-plugins-bad1.0-0

swolchok 10y ago

As a cheap extra layer of protection, you could install the version of Linux Mint you've got installed on your real machine in a VM and then run the exploit in the VM. You could also do it from a VirtualBox installation on EC2 to get extra security: if things go south (or as a matter of good hygiene), you can disable the EC2 instance from the EC2 dashboard after you're done.