5 ms·
Here is the test program, from http://www.openwall.com/lists/oss-security/2015/01/27/9 http://www.openwall.com/lists/oss-security/2015/01/27/9 https://gist.git
by DangerousPie 12y ago
Here is the test program, from http://www.openwall.com/lists/oss-security/2015/01/27/9 http://www.openwall.com/lists/oss-security/2015/01/27/9
https://gist.github.com/koelling/ef9b2b9d0be6d6dbab63 https://gist.github.com/koelling/ef9b2b9d0be6d6dbab63
To test your system, simply run this (but obviously only after making sure gistfile1.c is clean ;))
wget https://gist.githubusercontent.com/koelling/ef9b2b9d0be6d6dbab63/raw/de1730049198c64eaf8f8ab015a3c8b23b63fd34/gistfile1.c
gcc gistfile1.c -o CVE-2015-0235
./CVE-2015-0235
- windsurfer 12y agoI always laugh when people give you a URL to C code to test for remote code execution...
- fletchowns 12y agoMight as well throw a --no-check-certificate in there
- toddsiegel 12y agoI agree, it is funny, but we run code we can't even see all day long. This is only 38 LOC. Anyone who is going to run it, however, should make sure they understand it.
- tedunangst 12y agoAs opposed to code in some other language?
- fragmede 12y agoWhy? Reproducers are standard fare and it's not like the code in this case is obfuscated. Are magic code goblins going to come and invoke Ken Thompson's untrustable computing and make your computer install windows and join a botnet or something?
- Natsu 12y agoYou're piping random executables from the internet without even looking at them to see what they do if you run that command.
- Xylakant 12y agoThere's no pipe involved in the GPs posting. It downloads a source file and the post even points out to check the file before compiling. I actually copied and pasted the test code from the original advisory. Should I have typed it in with my own bare fingers to be more secure? I agree with your sentiment in general, you just picked the wrong example to bash here.
- acveilleux 12y agoThe average Linux IT guy will not read the C code. Many of them wouldn't be able to really understand what it does either. And this is best case code is simple and easy to grok.
- Xylakant 12y agoIf you're not reading the code you can just as well curl-and-pipe it. However, we run so much code on our computers that is trusted-by-association (oh, that's from apache.org, that's probably safe!) that it probably does not matter anyways.
- Natsu 12y agoI was responding to the later posts who were confused as to why someone would laugh at seeing that. You're right that you said to check and I wasn't trying to bash that post at all. That aside, I actually did type it into my disposable VM. The theory being that if there was something subtle, it would force me either to type it wrong and not be exploited due to cognitive blindness or I'd catch the problem and avoid it. I've read too many IOCC entries and I probably am a bit paranoid.
- peteretep 12y ago
- cellover 12y agoYou know you can also read the source code right? Even if you are not proficient with c you can understand what it's doing.
- voltagex_ 12y agoAnyone know how reliable that test is? I've got a system reporting not vulnerable but I'm not sure what glibc it has.
- pb2au 12y agoglibc 2.18 and greater were already patched, but it wasn't recognized as an RCE vulnerability at the time. See the first bullet under the "Mitigating factors" section in the link. You can check your libc version with: ldd --version
- elijahpaul 12y agoI've got a system reporting glibc 2.11, but the test reports 'not vulnerable'.
- growthape 12y agoWe have already started to patch servers at Cloudways. Our CTO Pere Hospital explains how: http://www.cloudways.com/blog/ghost-vulnerability-patching/ http://www.cloudways.com/blog/ghost-vulnerability-patching/