Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.python > #85167

Re: Ghost vulnerability

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Tue, Feb 3, 2015 at 4:53 AM, Rustom Mody <rustompmody@gmail.com> wrote:

> How many people (actually machines) out here are vulnerable?
>
>
> http://security.stackexchange.com/questions/80210/ghost-bug-is-there-a-simple-way-to-test-if-my-system-is-secure
>
> shows a python 1-liner to check
> --
> https://mail.python.org/mailman/listinfo/python-list
>



Not very reliable in my experience,

this python test does segfault on my *patched* Debian machine

root@web:~# python -c 'import socket;y="0"*50000000;socket.gethostbyname(y)'
Segmentation fault

However, the other test proposed on stackechange correctly reports that I'm
not vulnerable ;)
root@web:/tmp# wget
https://webshare.uchicago.edu/orgs/ITServices/itsec/Downloads/GHOST.c
root@web:/tmp# gcc GHOST.c -o GHOST
root@web:/tmp# ./GHOST
not vulnerable


-- 
Marc

Back to comp.lang.python | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Ghost vulnerability Rustom Mody <rustompmody@gmail.com> - 2015-02-02 19:53 -0800
  Re: Ghost vulnerability Chris Angelico <rosuav@gmail.com> - 2015-02-03 15:38 +1100
  Re: Ghost vulnerability Anssi Saari <as@sci.fi> - 2015-02-03 11:53 +0200
    Re: Ghost vulnerability Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2015-02-03 22:19 +1100
      Re: Ghost vulnerability Michael Torrie <torriem@gmail.com> - 2015-02-03 10:31 -0700
      Re: Ghost vulnerability Anssi Saari <as@sci.fi> - 2015-02-03 21:38 +0200
        Re: Ghost vulnerability Chris Angelico <rosuav@gmail.com> - 2015-02-04 09:08 +1100
        Re: Ghost vulnerability Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2015-02-04 13:13 +1100
  Re: Ghost vulnerability Marc Aymerich <glicerinu@gmail.com> - 2015-02-03 18:47 +0100

csiph-web