Application Security

02:55 PM
Connect Directly

Glibc Flaw Affects Thousands Of Linux Apps But How Dangerous Is It?

The difficulty involved in exploiting flaw could mitigate some of the risk, say some security researchers.

Security researchers appear somewhat divided over the extent of the danger posed by a major bug in a shared library used in thousands of Linux-based applications and systems worldwide.

Researchers at Google and Red Hat disclosed the vulnerability in glibc on Tuesday. They described the issue as a critical buffer overflow vulnerability which, when exploited, could give an attacker complete remote control of systems running the affected software.

The major Linux distributors and the glibc project, which maintains the library, have issued patches for fixing the issue in vulnerable products.

Glibc, or GNU C Library, is a version of the main C-Library (libc) that Unix systems rely on to run. It contains a set of all the standard features and functions required by Unix systems.  Though there are multiple versions of the C-library, glibc is by far the most popular and is used by all major Linux distributions, according to security researchers.

“Pretty much every program uses functions defined in this library,” says Johannes Ullrich, dean of research for the SANS Technology Institute. BSD based operating systems like OS X, iOS, OpenBSD,and Free BSD tend to use their own version of libc. “But even in these cases, it is possible to find individual pieces of software that use glibc, in particular if the software was ported from a Linux based system,” he says.

As a result, potentially thousands of applications are potentially vulnerable to the flaw, disclosed this week.

The flaw itself is present in the glibc DNS client side resolver and is triggered when a particular library function called getaddrinfo() is used.

“The issue is in the way that domain name responses are handled,” says Tod Beardsley, security research manager at Rapid7. “An attacker who controls a DNS server can cause a program to crash, and under some circumstances can hijack the execution path of the program.” Software packages on both traditional platforms and embedded devices, such as routers and IoT devices are vulnerable to the issue, he says.

According to Google and Red Hat, attackers using domain names or DNS servers under their control or via a man-in-the-middle attack can exploit any software that uses the vulnerable library.

“[This is a] fairly big deal since DNS is a core infrastructure component for the Internet, and this involves processing of malicious DNS replies to legitimate DNS requests,” says Mark Loveless senior security researcher at Duo Security. “As it is in glibc, a core component used in most Linux distributions, it exposes a lot of systems to risk.”

But not everyone is agreed on the actual extent of the danger posed by the bug.

Ullrich is of the opinion that the bug is not terribly difficult to exploit if left unpatched. Google already has a working exploit for the flaw and any attacker reasonably skilled in exploit development could likely do the same, he says.

In order to exploit the flaw, the attacker has to trick the victim to send a specific DNS query but that is typically not very hard, he says. “When visiting websites, processing emails and doing pretty much anything network related your system constantly emits DNS queries. The attackers will then respond with the exploit. So the attacker may need to be somewhat patient, but beyond that, it shouldn’t be too difficult to exploit this flaw,” Ullrich says.

But others like Loveless think that the danger posed by the bug is somewhat mitigated by the work required to actually exploit it.

“One of the complexities involves being in the right place,” he says. “The attacker must be able to either anticipate the DNS request before sending the malicious reply, or to sniff the victim's traffic and in real time respond to a legitimate DNS request with a malicious reply.”

In order for this to happen, the attacker has to be in control of a domain or a DNS server that they know the victim will connect to. Or they need to be in close enough proximity to the victim to be able to launch a Man-In-The-Middle attack, Loveless says.

Developing a working exploit is not going to be especially easy either, he says. The attacker would need to not only have an exploit capable of triggering the flaw but also of bypassing security measures like Address Space Layout Randomization (ASLR) that the target system may have in place for dealing with buffer overflow attacks.

Most IoT devices, which are where the flaw is likely to be highly prevalent, also only connect to a few, known endpoints, Beardsley says. So [an attacker] would either need to hijack the network connection entirely via a Man-in-the-Middle attack, or find a process that makes connections to user-supplied domains, such as a web crawler that follows arbitrary links,” he says.

“Therefore, while the vulnerability is interesting, I don't find [it] all that dangerous for the vast majority of the Internet,” Beardsley said. “People who can patch, should, and those who cannot patch likely have more pressing issues, like exposed Shellshock vulnerabilities that should be addressed first.”

More on this topic:

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Devastating Cyberattack on Email Provider Destroys 18 Years of Data
Jai Vijayan, Freelance writer,  2/12/2019
Up to 100,000 Reported Affected in Landmark White Data Breach
Kelly Sheridan, Staff Editor, Dark Reading,  2/12/2019
Register for Dark Reading Newsletters
White Papers
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-02-15
An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c has an integer overflow on the result of multiplication fed into malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow.
PUBLISHED: 2019-02-15
An issue was discovered in SoX 14.4.2. In xmalloc.h, there is an integer overflow on the result of multiplication fed into the lsx_valloc macro that wraps malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow in channels_start in remix.c.
PUBLISHED: 2019-02-15
An issue was discovered in SoX 14.4.2. One of the arguments to bitrv2 in fft4g.c is not guarded, such that it can lead to write access outside of the statically declared array, aka a stack-based buffer overflow.
PUBLISHED: 2019-02-15
An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c allows a NULL pointer dereference.
PUBLISHED: 2019-02-15
Vulnerability in FileUtils v0.7, Ruby Gem Fileutils <= v0.7 Command Injection vulnerability in user supplied url variable that is passed to the shell.