[Linux] Linux Glibc库安全漏洞检测方法和修复方案

#include <netdb.h> 
#include <stdio.h> 
#include <stdlib.h> 
#include <string.h> 
#include <errno.h> 
#define CANARY "in_the_coal_mine" 
struct { 
char buffer[1024]; 
char canary[sizeof(CANARY)]; 
} temp = { "buffer", CANARY }; 
int main(void) { 
struct hostent resbuf; 
struct hostent *result; 
int herrno; 
int retval; 
/*** strlen (name) = size_needed -sizeof (*host_addr) - sizeof (*h_addr_ptrs) - 1; ***/ 
size_t len = sizeof(temp.buffer) -16*sizeof(unsigned char) - 2*sizeof(char *) - 1; 
char name[sizeof(temp.buffer)]; 
memset(name, '0', len); 
name[len] = '\0'; 
retval = gethostbyname_r(name,&resbuf, temp.buffer, sizeof(temp.buffer), &result, &herrno); 
if (strcmp(temp.canary, CANARY) !=0) { 
puts("vulnerable"); 
exit(EXIT_SUCCESS); 
} 
if (retval == ERANGE) { 
puts("notvulnerable"); 
exit(EXIT_SUCCESS); 
} 
puts("should nothappen"); 
exit(EXIT_FAILURE);
}

gcc GHOST.c -o GHOST</p> <p>$./GHOST
vulnerable //表示存在漏洞，需要进行修复。</p> <p>$./GHOST
notvulnerable //表示修复成功。

yum update glibc

apt-get update
apt-get install libc6

wget -O /etc/apt/sources.list.d/debian6-lts.list <a href="http://mirrors.aliyun.com/repo/debian6-lts.list">http://mirrors.aliyun.com/repo/debian6-lts.list</a>
apt-get update
apt-get install libc6

apt-get update
apt-get install libc6

zypper refresh
zypper update glibc*

wget -O /etc/yum.repos.d/aliyun-5.repo <a href="http://mirrors.aliyun.com/repo/aliyun-5.repo">http://mirrors.aliyun.com/repo/aliyun-5.repo</a>
yum update glibc