CVE_2015_0235 glibc의 gethostbyname*() 버퍼 오버플로 익스플로잇 - CVE-2015-0235 https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability

원래 Ben Bomgardner가 help-cfengine 메일링 리스트에 게시한 글에서 가져왔습니다. https://groups.google.com/forum/#!topic/help-cfengine/tWjOlO19Mrw

masterfiles로의 통합

** 정책을 다운로드하고 masterfiles에 압축을 해제하세요

#+begin_src sh MASTERFILES=/home/nickanderson/CFEngine/masterfiles wget https://github.com/nickanderson/CVE_2015_0235/archive/master.tar.gz -O /tmp/CVE_2015_0235.tar.gz tar --directory "$MASTERFILES/services" -zxvf /tmp/CVE_2015_0235.tar.gz #+end_src

** 테스트 익스플로잇은 컴파일해야 합니다.

#+begin_src sh cd $MASTERFILES/services/CVE_2015_2035/bins gcc GHOST.c -o GHOST_CVE-2015-0235 #+end_src

** def.cf 경로를 inputs에 포함시키세요

#+begin_src cfengine body common control { inputs => { # Reports @(cfengine_reports.inputs),

                # If you want to activate this policy from autorun,
                # then it needs to be included before autorun
                # inptus.
                "services/CVE_2015_0235/def.cf",
                
                # autorun system
                @(services_autorun.inputs),
    };

} #+end_src

정책에서 활성화하기 (autorun 사용)

다음 내용으로 /masterfiles/services/autorun/CVE_2015_0235.cf 파일을 생성하세요.

#+begin_src cfengine bundle agent CVE_2015_0235 { meta: # Make sure we get activated "tags" slist => { "autorun" };

classes:
  any::
    # Enable the features we want
    "enable_CVE_2015_0235_inventory" expression => "any";

methods:
      # Make sure that the control bundle has converged
    "CVE_2015_0235"
      usebundle => CVE_2015_0235_def_file_control,
      comment => "Activate each enabled policy";
    
  # Activate the features we want if they are enabled
  enable_CVE_2015_0235_inventory::
    "CVE_2015_0235"
      usebundle => CVE_2015_0235_inventory,
      comment => "We want to know where we are vulnerable";

reports:
  DEBUG|DEBUG_CVE_2015_0235::
    "Activated: '$(this.bundle)' in '$(this.promise_filename)'";

} #+end_src

cfengine-CVE_2015_0235

인기