1. GHOST 2.0: What you need to know about the glibc getaddrinfo vulnerability (CVE 2015-7547) Johannes B. Ullrich, Ph.D, SANS jullrich@sans.edu https://isc.sans.edu

2. from the most trusted name in information security The Basics: DNS 2

3. from the most trusted name in information security The Basics: DNS 3 isc.sans.edu

4. from the most trusted name in information security The Basics: DNS 4 isc.sans.edu 66.35.59.249

5. from the most trusted name in information security The Basics: DNS 5 isc.sans.edu 66.35.59.249 2607:f1c0:846:9100::15c

6. from the most trusted name in information security On the wire 10.128.0.8.50206 > 10.5.1.86.53: 36536+ A? isc.sans.edu. 10.128.0.8.50206 > 10.5.1.86.53: 55864+ AAAA? isc.sans.edu. 10.5.1.86.53 > 10.128.0.8.50206: 36536 1/4/4 A 66.35.59.249 10.5.1.86.53 > 10.128.0.8.50206: 55864 1/4/4 AAAA 2607:f1c0:846:… 6

7. from the most trusted name in information security On the wire 10.128.0.8.50206 > 10.5.1.86.53: 36536+ A? isc.sans.edu. 10.128.0.8.50206 > 10.5.1.86.53: 55864+ AAAA? isc.sans.edu. 10.5.1.86.53 > 10.128.0.8.50206: 36536 1/4/4 A 66.35.59.249 10.5.1.86.53 > 10.128.0.8.50206: 55864 1/4/4 AAAA 2607:f1c0:846:… 7

8. from the most trusted name in information security What went wrong? Victim sends A and AAAA query. 2048 bytes are allocated on the stack Attacker sends first response: Exactly 2048 bytes New buffer needs to be allocated on heap (not stack). But instead, old buffer is used with a claimed size of 64k. Attacker sends second response, that triggers a retry Attacker sends third response: 2048 bytes valid response data and 63487 bytes of attack payload 8

9. from the most trusted name in information security PoC Publicly available PoC python script that implements DNS server with corrupt response Crashes clients using a vulnerable version of glibc Google claims to have a remote code execution exploit Exploit most likely for UDP, but possible for TCP 9

10. from the most trusted name in information security Timeline November 2008: glibc 2.9 released (1 st vulnerable version) July 2015 bug created (not considered security issue initially) August 2015 identified as possible security issue February 2016 fixed / patch released for various versions of glibc. 10

11. from the most trusted name in information security Severity Remote code execution possible Many Linux systems affected (Debian, RedHat, Gentoo, Ubuntu…Cisco!) Not affected: BSD (OS X, iOS...) many embeded Linux version (typically using uClib), Android (uses Bionic) Non-affected system *may* be affected by software that includes glibc CVSS Base Score: 10.0 11

12. from the most trusted name in information security glibc version $ /lib/arm-linux-gnueabihf/libc.so.6 GNU C Library (Debian GLIBC 2.19-18+deb8u2 ) stable release version 2.19, by Roland McGrath et al. Copyright (C) 2014 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Compiled by GNU CC version 4.8.2 Compiled on a Linux 3.13.11 system on 2016-02-16 12

13. from the most trusted name in information security How does it compare to GHOST (2015-0235)? Same library (glibc), similar function (gethostbyname) Simpler exploit (e.g. metasploit module available. GHOST typically affected older software, but overall scope similar GHOST affected glibc 2.6-2.17 If you had to patch for GHOST, then you also have to patch for CVE-2015-7547 13

14. from the most trusted name in information security Mitigation: Recursive Resolvers 14 isc.sans.edu 66.35.59.249 2607:f1c0:846:9100::15c

15. from the most trusted name in information security Mitigation: Recursive Resolvers 15 isc.sans.edu 66.35.59.249 2607:f1c0:846:9100::15c.edu. sans.edu.

16. from the most trusted name in information security Mitigation: Recursive Resolvers Likely helps, but can probably be bypassed Helps detect exploitation and blocking exploits “best practice” anyway. Lots of advantages of using DNS as a choke point for network monitoring Helps with DNS blacklists Monitoring for DNS data exfiltration Improves performance Using a “known good” forwarder can help (OpenDNS, Google DNS, ISP…) 16

17. from the most trusted name in information security Mitigation: Recursive Resolvers “A back of the envelope analysis shows that it should be possible to write correctly formed DNS responses with attacker controlled payloads that will penetrate a DNS cache hierarchy and therefore allow attackers to exploit machines behind such caches. 17

18. from the most trusted name in information security Mitigation: Turning off EDNS0 Helps prevent UDP vector. Will prevent first large packet from being received. May not help with TCP vector, but TCP vector is considered more difficult to exploit. TCP session size has to be limited to 1024 Bytes May break DNSSEC May affected performance 18

19. from the most trusted name in information security Mitigation: Turn off / blocking IPv6 Does not help! Client may still send A/AAAA queries Only if getaddrinfo isn’t called with “AF_UNSPEC” (which is bad … breacks IPv6) 19

20. from the most trusted name in information security Demo – ”telnet” and “dig” against PoC 20 isc.sans.edu PoC

21. from the most trusted name in information security Demo: Recursive Resolver 21 isc.sans.edu ? PoC

22. from the most trusted name in information security Risk A limited remote code execution exploit is likely (my guess: 2 weeks?) Exploitation requires the victim to request a malicious DNS record, which is easy to accomplish for web clients, mail servers. Less likely for DB server, Web Servers (but possible Detection can be tricky No complete “simple” mitigation Test resolvers! 22

23. from the most trusted name in information security Risk A limited remote code execution exploit is likely (my guess: 2 weeks?) Exploitation requires the victim to request a malicious DNS record, which is easy to accomplish for web clients, mail servers. Less likely for DB server, Web Servers (but possible Detection can be tricky No complete “simple” mitigation 23 PATCH

24. from the most trusted name in information security Questions? Thank You! jullrich@sans.edu https://isc.sans.edu Daily Podcast * Data * Diaries Join our Raspberry Pi Sensor Network 24