Re: GNU C Library: Multiple vulnerabilities

On Fri, Feb 19, 2016 at 11:53:25PM -0500, Kevin W. Wall ([email protected]) wrote:

> Great idea. What should go under the 'stop' part of the script though?
> 
>     iptables -X CUSTOMINPUT
> 
> probably will work, but could have unintended side-effect if that chain has
> other rules you don't want to remove.

It doesn't really matter much, normally rc.firewall.local is only
called by rc.firewall which already deletes all chains, so you
could even leave the stop action empty. I'm, however, using

iptables -F CUSTOMINPUT

which effectively returns things back to as they were before
"rc.firewall.local start" (CUSTOMINPUT exists but is empty).
That way I can start and stop rc.firewall.local manually and
it behaves consistently.

If you have some other scripts messing with CUSTOMINPUT you could
explicitly delete just the rules you've added in "start" with

iptables -D ...

for each of them.

--
Tapani Tarvainen

> On Feb 19, 2016 12:48 PM, "Tapani Tarvainen" <ipcop-IXVv/[email protected]>
> wrote:
> 
> > Yes it is, at least CVE-2015-7547. And it should be patched ASAP.
> >
> > As an interim band-aid, something like this in rc.firewall.local might
> > help:
> >
> > iptables -A CUSTOMINPUT -p udp -m udp --dport 53 -m length --length
> > 513:65535 -j DROP
> > iptables -A CUSTOMINPUT -p tcp -m tcp --dport 53 -m length --length
> > 1025:65535 -j DROP
> >
> > --
> > Tapani Tarvainen
> >
> > On Thu, Feb 18, 2016 at 07:21:47PM +0100, Dan Johansson ([email protected])
> > wrote:
> >
> > > Hi All,
> > >
> > > Does anyone here know if IPCop (2.1.9) is affected by these glibc
> > > vulnerabilities:
> > >
> > > * The Google Security Team and Red Hat discovered a stack-based buffer
> > >   overflow in the send_dg() and send_vc() functions due to a buffer
> > >   mismanagement when getaddrinfo() is called with AF_UNSPEC
> > >   (CVE-2015-7547).
> > > * The strftime() function access invalid memory when passed
> > >   out-of-range data, resulting in a crash (CVE-2015-8776).
> > > * An integer overflow was found in the __hcreate_r() function
> > >   (CVE-2015-8778).
> > > * Multiple unbounded stack allocations were found in the catopen()
> > >   function (CVE-2015-8779).
> > >
> > > Regards,
> > > --
> > > Dan Johansson
> > > ***************************************************
> > > This message is printed on 100% recycled electrons!
> > > ***************************************************

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user