[B! GHOST][è„†å¼±æ€§] ionisã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ionis id:ionis

GHOSTã¨è„†å¼±æ€§ã«é–¢ã™ã‚‹ionisã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (7)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

GHOST è„†å¼±æ€§ã¯å¦‚ä½•æ§˜ã«ä½¿ã†ã®ã‹ | Webã‚·ã‚¹ãƒ†ãƒ é–‹ç™ºï¼æ•™è‚²ã‚½ãƒªãƒ¥ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚¿ã‚¤ãƒ ã‚¤ãƒ³ã‚¿ãƒ¼ãƒ¡ãƒ‡ã‚£ã‚¢
å…ˆæ—¥ GHOST ã¨å‘¼ã°ã‚Œã‚‹ glibc ã®è„†å¼±æ€§ãŒç™ºè¡¨ã•ã‚ŒãŸã€‚ãªã‚“ã§ã‚‚ã€ã€Œãƒªãƒ¢ãƒ¼ãƒˆã‹ã‚‰ä»»æ„ã®ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã§ãã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã€ã‚‰ã—ã„ã§ã¯ãªã„ã‹ã€‚ã—ã‹ã‚‚æ§˜ã€…ãªãƒ—ãƒã‚°ãƒ©ãƒ ã§åˆ©ç”¨ã•ã‚Œã¦ã„ã‚‹ãƒ©ã‚¤ãƒ–ãƒ©ãƒªéƒ¨åˆ†ã®å•é¡Œã¨ã‚ã£ã¦ã€å½±éŸ¿ç¯„å›²ãŒã¨ã¦ã‚‚åºƒã„ã€‚ãªã‹ãªã‹åŽ„ä»‹ãªã“ã¨ã§ã‚ã‚‹ã€‚ ã¯ã¦ã€ã—ã‹ã—ä¸€ä½“å…¨ä½“ã©ã†ã‚„ã£ã¦ãƒªãƒ¢ãƒ¼ãƒˆã‹ã‚‰ä»»æ„ã®ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã—ã‚ˆã†ã¨ã„ã†ã®ã ã‚ã†ï¼Ÿ è©±ã‚’èžãã«ã€ãŸã‹ãŒæ•°ãƒã‚¤ãƒˆã®æƒ…å ±ã‚’ç¯„å›²å¤–ã®ãƒ¡ãƒ¢ãƒªã«æ›¸ãè¾¼ã‚ã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã ã‘ã ã¨ã„ã†ã€‚å®Ÿéš›ãã‚Œã ã‘ã®ã“ã¨ã§ã‚µãƒ¼ãƒãƒ¼ã®ä¹—ã£å–ã‚Šãªã©ã§ãã‚‹ã‚‚ã®ãªã®ã ã‚ã†ã‹ã€‚ãã‚“ãªã‚ã‘ã§ã€ãã®ç–‘å•ã«ç”ãˆã‚‹ã¹ãã€æœ¬è¨˜äº‹ã§ã¯ä»¥ä¸‹ã® URL ã§è§£èª¬ã•ã‚Œã¦ã„ã‚‹å®Ÿéš›ã®æ”»æ’ƒæ–¹æ³•ã‚’è‹¥å¹²ç«¯æŠ˜ã£ã¦ç´¹ä»‹ã—ã¦ã¿ã‚ˆã†ã¨æ€ã†ã€‚ http://www.openwall.com/lists/oss-security/2015/01/27/9 ãªãŠã€æœ¬è¨˜äº‹ã¯ã“ã®è„†å¼±æ€§ãã®ã‚‚ã®ã«å¯¾ã™ã‚‹ç·Šæ€¥åº¦ãªã©ã«ã¤ã„ã¦è¨€
ionis 2015/01/30
GHOST

è„†å¼±æ€§

glibc
ãƒªãƒ³ã‚¯
PHP Applications, WordPress Subject to Ghost glibc Vulnerability
ionis 2015/01/30
php -r '$e="0";for($i=0;$i<2500;$i++){$e="0$e";} gethostbyname($e);' ã¨ã¯è‰¯ã„äº‹ã‚’èžã„ãŸã€‚è¨˜äº‹ä¸ã®ãƒ¤ãƒ„ã¯å¾®å¦™ã«ã‚¯ã‚©ãƒ¼ãƒˆã¨ã‹ãŒé•ã†ã‹ã‚‰ã‚³ãƒ”ãƒšæ™‚ã¯ç›´ã—ã¦ã‹ã‚‰ã€‚

GHOST

glibc

PHP

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
GHOSTè„†å¼±æ€§ã®å•é¡Œã‚’ç·©å’Œã™ã‚‹è¦ç´ ã«ã¤ã„ã¦ï¼ˆ GHOSTè„†å¼±æ€§å‹§å‘Šæ›¸ã®ä¸€éƒ¨ã‚’ç¿»è¨³ï¼‰ - ã‚¿ã‚ªãƒ«ã‚±ãƒƒãƒˆä½“æ“
ã¤ã„æ•°æ™‚é–“å‰ã«å˜åœ¨ã‚’çŸ¥ã‚Šã¾ã—ãŸã€‚ æŸãƒ‹ãƒ¥ãƒ¼ã‚¹ã‚µã‚¤ãƒˆã¨ã‹ã§ã€Œãƒžã‚¸ã‚„ã¹ãˆä»Šã™ãå¯¾å‡¦ã—ãªã„ã¨æ»ã¬ãžã€ã¿ãŸã„ãªã“ã¨ã‚’æ›¸ã‹ã‚Œã¦ã„ãŸã®ã§è¶…ç„¦ã£ã¦ã„ãŸã®ã§ã™ãŒã€ã‹ãã‹ãã—ã‹ã˜ã‹ã®ç†ç”±ã§ç‹¬è‡ªãƒ‘ãƒƒãƒã®ä½œæˆã‚’æ¤œè¨Žã™ã‚‹ãŸã‚ã« https://www.qualys.com/research/security-advisories/GHOST-CVE-2015-0235.txt ã®å ±å‘Šæ›¸ã‚’èªã‚“ã§ã„ãŸã¨ã“ã‚ã€ãã“ã¾ã§è¶…ãƒ¤ãƒã„æ€¥ãŽã®è¦ä»¶ã§ã‚‚ãªããï¼Ÿ ã¿ãŸã„ãªæ„Ÿã˜ã«ãªã£ãŸã®ã§å…±æœ‰ã—ã¾ã™ã€‚ ãªãŠã€ç§ã®è‹±èªžåŠ›ãŒãƒ¤ãƒ ãƒãƒ£ãƒ¬ãƒ™ãƒ«ã§ã‚ã‚‹ã“ã¨ã€ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚„Linuxã‚·ã‚¹ãƒ†ãƒ ã«é–¢ã‚ã‚‹çŸ¥è˜ãŒãƒãƒ£ã‚ªã‚ºãƒ¬ãƒ™ãƒ«ã§ã‚ã‚‹ã“ã¨ã€æ€¥ãŽã®ç¿»è¨³ãªã®ã§ä»–ã®ç¯€ã¯ã»ã¨ã‚“ã©èªã‚ã¦ã„ãªã„ã“ã¨ã€ã‚ãã¾ã§2014å¹´1æœˆ28æ—¥æ™‚ç‚¹ã§ã®æƒ…å ±ã§ã‚ã‚‹ã“ã¨ã€ãªã©ã®ç†ç”±ã‹ã‚‰èª¤è§£ã€èª¤è¨³ãŒå«ã¾ã‚Œã¦ã„ã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ å‚ç…§ã™ã‚‹ã®ã¯ã‚ãã¾ã§å…ƒã®å ±å‘Šæ›¸ã‚’ãƒ™ãƒ¼ã‚¹ã«ã—ã¦ã€ã‚ã¨ã¯è‡ªå·±è²¬ä»»ã§
ionis 2015/01/28
GHOST

ç¿»è¨³

glibc

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
The Laws of Vulnerabilities: The GHOST Vulnerability | Qualys Community
The GHOST vulnerability is a serious weakness in the Linux glibc library. It allows attackers to remotely take complete control of the victim system without having any prior knowledge of system credentials. CVE-2015-0235 has been assigned to this issue. Qualys security researchers discovered this bug and worked closely with Linux distribution vendors. And as a result of that we are releasing this
ionis 2015/01/28
ç”»åƒå¯æ„›ã„ã€‚advisoryè¦‹ã¦ã‚‹ã¨ã€æƒ³åƒã‚ˆã‚Šã¯ãƒªãƒ¢ãƒ¼ãƒˆã‹ã‚‰ã¯å¯¾è±¡ãŒé™å®šçš„ãªæ°—ãŒã™ã‚‹ã€‚update&rebootå‡ºæ¥ã‚‹é™ã‚Šã™ã¹ããªã®ã¯é–“é•ã„ãªã„ã€‚

è„†å¼±æ€§

GHOST

glibc
ãƒªãƒ³ã‚¯
CVE-2015-0235 é‡è¦ãªãƒ‘ãƒƒãƒ (ã‚´ãƒ¼ã‚¹ãƒˆ)
2015 å¹´ 1 æœˆ 28 æ—¥åˆå‰ 7 æ™‚ 45 åˆ† (å¤§æ´‹å¹³æ¨™æº–æ™‚) - æ›´æ–° AWS Elastic Beanstalk - Elastic Beanstalk ã®æ›´æ–°ãŒå®Œäº†ã—ã€ãŠå®¢æ§˜ãŒç’°å¢ƒã«é©ç”¨ã§ãã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸã€‚æ—¢å˜ã®ç’°å¢ƒã‚’ä½¿ç”¨ã—ã¦ã„ã‚‹ãŠå®¢æ§˜ã¯ã€ã‚¢ã‚¯ã‚·ãƒ§ãƒ³ã‚’å®Ÿè¡Œã™ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚ã”ä½¿ç”¨ã®ç’°å¢ƒã«ãƒ‘ãƒƒãƒã‚’é©ç”¨ã™ã‚‹ãŸã‚ã®å…·ä½“çš„ãªæ‰‹é †ã«ã¤ã„ã¦ã¯ã€Elastic Beanstalk ãƒ•ã‚©ãƒ¼ãƒ©ãƒ ã®ãŠçŸ¥ã‚‰ã› (https://forums.aws.amazon.com/ann.jspa?annID=2855) ã‚’ã”è¦§ãã ã•ã„ã€‚2015/1/28 @ 6AM (å¤ªå¹³æ´‹æ¨™æº–æ™‚) ä»¥é™ã«é–‹å§‹ã•ã‚ŒãŸã™ã¹ã¦ã®æ–°ã—ã„ç’°å¢ƒã«ã¯ãƒ‘ãƒƒãƒãŒã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚Œã€ãŠå®¢æ§˜ã‹ã‚‰ã®ã•ã‚‰ãªã‚‹ã‚¢ã‚¯ã‚·ãƒ§ãƒ³ã¯ä¸è¦ã§ã™ã€‚ -------------------------------------------------------
ionis 2015/01/28
è„†å¼±æ€§

GHOST

glibc
ãƒªãƒ³ã‚¯
https://www.qualys.com/2015/01/27/cve-2015-0235/GHOST-CVE-2015-0235.txt
ionis 2015/01/28
è„†å¼±æ€§

GHOST

glibc
ãƒªãƒ³ã‚¯
glibc ã®è„†å¼±æ€§ CVE-2015-0235ï¼ˆé€šç§°ï¼šGHOSTï¼‰ã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog
2015å¹´1æœˆ27æ—¥(ç¾åœ°æ™‚é–“) Qualysã¯glibc(GNU C Library)ã«è„†å¼±æ€§ã‚’ç™ºè¦‹ã—ã€æƒ…å ±ã‚’å…¬é–‹ã—ã¾ã—ãŸã€‚ã“ã“ã§ã¯é–¢é€£æƒ…å ±ã‚’ã¾ã¨ã‚ã¾ã™ã€‚(æš«å®šã¾ã¨ã‚ãªã®ã§ç²¾åº¦ä½Žã‚ã€ç¶²ç¾…æ€§ç„¡ã—ã§ã™ã€‚ã€‚) (1) è„†å¼±æ€§é–¢é€£æƒ…å ± QualysãŒå…¬é–‹ã—ãŸè„†å¼±æ€§æƒ…å ± The GHOST Vulnerability Qualys Security Advisory CVE-2015-0235 æ³¨æ„å–šèµ· IPA (æ³¨æ„) libc ã®è„†å¼±æ€§å¯¾ç–ã«ã¤ã„ã¦(CVE-2015-0235) è„†å¼±æ€§ã®æ¦‚è¦ glibcã®__nss_hostname_digits_dots() ã«ãƒ’ãƒ¼ãƒ—ãƒãƒƒãƒ•ã‚¡ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ã®è„†å¼±æ€§ã€‚ å½“è©²é–¢æ•°ã¯glibcã®gethostbyname()ã¨gethostbyname2()ã‹ã‚‰å‘¼ã°ã‚Œã¦ã„ã‚‹ã€‚ ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ã‚ˆã£ã¦ã¯ã€DoSã€ã¾ãŸã¯ãƒªãƒ¢ãƒ¼ãƒˆã‹ã‚‰ä»»æ„ã®ã‚³ãƒ¼ãƒ‰ãŒå®Ÿè¡Œå¯èƒ½ã¨ãªã‚‹å¯èƒ½æ€§
ionis 2015/01/28
è„†å¼±æ€§

ã¾ã¨ã‚

glibc

GHOST
ãƒªãƒ³ã‚¯
1