{"vulnerability": "cve-2015-7547", "sightings": [{"uuid": "20f86e90-b15a-4c27-8413-ad366d3a46ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7547", "type": "exploited", "source": "https://www.exploit-db.com/exploits/39454", "content": "", "creation_timestamp": "2016-02-16T00:00:00.000000Z"}, {"uuid": "cc83e973-2e8e-43c0-9354-a65e2fb8358e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7547", "type": "seen", "source": "https://bsky.app/profile/daffyduke.bsky.social/post/3lg3xtsaqpz2e", "content": "", "creation_timestamp": "2025-01-19T13:52:15.010593Z"}, {"uuid": "6f235c46-ec5b-40ed-97dc-c7ae88c34284", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2015-7547", "type": "seen", "source": "https://gist.github.com/tamer1an/d3cf5cdbec1b41112d4ed8bd8bdebcf8", "content": "", "creation_timestamp": "2025-09-11T11:55:23.000000Z"}, {"uuid": "b5024f66-c289-4424-9e28-86003b747c51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7547", "type": "seen", "source": "https://t.me/itsecalert/12", "content": "\u26a0\ufe0f CVE-2015-7547: glibc getaddrinfo stack-based buffer overflow vulnerability - potentially all linux OS affected. (severity: \ud83d\udd38high) Further Information: http://yt.gl/20157547\n#alert #vulnerability #severityhigh #linux #glibc\nThanks to the anonymous user reporting it via https://infected.io/telegram-submission", "creation_timestamp": "2016-02-16T19:13:56.000000Z"}, {"uuid": "ccf7a313-1e3d-433a-86e6-ff5843ae4577", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7547", "type": "seen", "source": "https://t.me/informationsec/693", "content": "\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062a\u06a9\u0645\u06cc\u0644\u06cc \u062f\u0631 \u062e\u0635\u0648\u0635 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc Glibc \u0648 \u0631\u0648\u0634\u0647\u0627\u06cc Mitigation \u0622\u0646\n\nhttps://sourceware.org/bugzilla/show_bug.cgi?id=18665\n\n- Mitigating factors for UDP include:\n\u00a0 - A firewall that drops UDP DNS packets > 512 bytes.\n\u00a0 - A local resolver (that drops non-compliant responses).\n\u00a0 - Avoid dual A and AAAA queries (avoids buffer management error) e.g.\n\u00a0 \u00a0 Do not use AF_UNSPEC.\n\u00a0 - No use of options edns0 in /etc/resolv.conf since EDNS0 allows\n\u00a0 \u00a0 responses larger than 512 bytes and can lead to valid DNS responses\n\u00a0 \u00a0 that overflow.\n\u00a0 - No use of RES_USE_EDNS0 or RES_USE_DNSSEC since they can both\n\u00a0 \u00a0 lead to valid large EDNS0-based DNS responses that can overflow.\n\n- Mitigating factors for TCP include:\n\u00a0 - Limit all replies to 1024 bytes.\n\n- Mitigations that don't work:\n\u00a0 - Setting options single-request does not change buffer management\n\u00a0 \u00a0 and does not prevent the exploit.\n\u00a0 - Setting options single-request-reopen does not change buffer\n\u00a0 \u00a0 management and does not prevent the exploit.\n\u00a0 - Disabling IPv6 does not disable AAAA queries. The use of AF_UNSPEC\n\u00a0 \u00a0 unconditionally enables the dual query.\n\u00a0 \u00a0 - The use of sysctl -w net.ipv6.conf.all.disable_ipv6=1 will not\n\u00a0 \u00a0 \u00a0 protect your system from the exploit.\n\u00a0 - Blocking IPv6 at a local or intermediate resolver does not work to\n\u00a0 \u00a0 prevent the exploit. The exploit payload can be delivered in A or\n\u00a0 \u00a0 AAAA results, it is the parallel query that triggers the buffer\n\u00a0 \u00a0 management flaw.\n\n\u2796\u2796\u2796\u2796\n@informationsec\n\n\u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc Bind \u0628\u0631\u0627\u06cc truncation bit set(BIND 9 CONFIGURATION REFERENCE)\n\nnamed.conf \ud83d\udc49 options \ud83d\udc49rate-limit \ud83d\udc49 [ slip number ; ]\n\u2796\u2796\u2796\u2796\nDnsmasq\nhttp://www.thekelleys.org.uk/dnsmasq/doc.html\nhttps://wiki.debian.org/HowTo/dnsmasq\n\u2796\u2796\u2796\u2796\nASLR technique\nhttps://en.wikipedia.org/wiki/Address_space_layout_randomization\n\u2796\u2796\u2796\u2796\n@informationsec\n\nRule \u0647\u0627\u06cc \u067e\u06cc\u0634\u0646\u0647\u0627\u062f\u06cc  Mitigate \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062a\u0648\u0633\u0637 snort\nCVE-2015-7547 (GlibC bug) snort rules\nhttp://seclists.org/snort/2016/q1/285\n\u2796\u2796\u2796\u2796\n@informationsec\n\u0648\u0636\u0639\u06cc\u062a \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0648 \u062a\u062c\u0647\u06cc\u0632\u0627\u062a \u0648 \u0645\u062d\u0635\u0648\u0644\u0627\u062a \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631 Cisco\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160218-glibc\n\u2796\u2796\u2796\u2796\n\u0631\u0627\u0647\u06a9\u0627\u0631 \u067e\u06cc\u0634\u0646\u0647\u0627\u062f\u06cc \u0628\u0631\u0627\u06cc Mitigate \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 \u0645\u062d\u0635\u0648\u0644\u0627\u062a Cisco\nCVE-2015-7547, glibc vulnerability; its impact on Cisco products and our mitigation solutions\n\nhttp://info.stack8.com/blog/cve20157547-google-glibc-vulnerability-cisco-products\n\u2796\u2796\u2796\u2796\n\u0648\u0636\u0639\u06cc\u062a \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 Debian\nhttps://security-tracker.debian.org/tracker/CVE-2015-7547\n\u2796\u2796\u2796\u2796\nCVE-2015-7547-poc\nhttps://github.com/fjserna/CVE-2015-7547\n\n@informationsec", "creation_timestamp": "2026-08-22T14:00:21.301516Z"}, {"uuid": "b21133f8-99df-4e12-8581-835f66ae9796", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7547", "type": "seen", "source": "https://t.me/informationsec/692", "content": "\u0645\u0631\u0648\u0631\u06cc \u0628\u0631 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0627\u062e\u06cc\u0631 Glibc\n\n\u0627\u062d\u062a\u0645\u0627\u0644\u0627 \u0647\u0645\u0647 \u062f\u0648\u0633\u062a\u0627\u0646 \u0627\u0632 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0627\u062e\u06cc\u0631\u06cc \u06a9\u0647 \u062f\u0631 Glibc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0622\u06af\u0627\u0647\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646\u062f.  \u0628\u062d\u062b \u0647\u0627\u06cc \u0632\u06cc\u0627\u062f\u06cc \u062f\u0631 \u0627\u06cc\u0646 \u062e\u0635\u0648\u0635 \u062a\u0627 \u06a9\u0646\u0648\u0646 \u062f\u0631 \u0628\u06cc\u0646 \u0645\u062a\u062e\u0635\u0635\u06cc\u0646 \u0645\u0637\u0631\u062d \u0634\u062f\u0647 \u0648 \u0645\u0627 \u0631\u0627 \u0628\u0631 \u0622\u0646 \u062f\u0627\u0634\u062a \u06a9\u0647 \u0628\u0631\u0631\u0633\u06cc \u062f\u0642\u06cc\u0642 \u0648 \u062c\u0627\u0645\u0639 \u062a\u0631\u06cc \u062f\u0631 \u0627\u06cc\u0646 \u062e\u0635\u0648\u0635 \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u06cc\u0645.\n@informationsec\n\u062d\u062f\u0648\u062f \u06cc\u06a9 \u0633\u0627\u0644 \u067e\u06cc\u0634 \u0628\u0648\u062f \u06a9\u0647  glibc\u060c \u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647 GNU C \u060c \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc GHOST  \u0631\u0627 \u062a\u062c\u0631\u0628\u0647 \u06a9\u0631\u062f \u0648 \u0628\u0627\u0632 \u0647\u0645 \u0627\u0645\u0633\u0627\u0644 \u062f\u0631 \u0645\u0639\u0631\u0636 \u06cc\u06a9 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0645\u0647\u0645 \u062f\u06cc\u06af\u0631 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a. \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062a\u0642\u0631\u06cc\u0628\u0627 \u0628\u0631 \u062a\u0645\u0627\u0645 \u0645\u0627\u0634\u06cc\u0646 \u0647\u0627\u06cc \u0645\u0628\u062a\u0646\u06cc \u0628\u0631 Linux\u060c API web services  \u0648 web frameworks  \u0647\u0627\u06cc \u0628\u0632\u0631\u06af\u06cc \u06a9\u0647 \u062f\u0631 \u0622\u0646 \u0627\u06cc\u0646 \u06a9\u062f \u0627\u062c\u0631\u0627 \u0645\u06cc \u0634\u0648\u062f\u060c \u062a\u0623\u062b\u06cc\u0631 \u0645\u06cc \u06af\u0630\u0627\u0631\u062f.\n\n\u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647 Glibc \u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647 C \u06cc\u06cc \u0627\u0633\u062a \u06a9\u0647 systems call \u0647\u0627 \u0648 \u0633\u0627\u06cc\u0631 \u062a\u0648\u0627\u0628\u0639 \u067e\u0627\u06cc\u0647 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627\u06cc Linux \u06cc\u06cc \u0634\u0627\u0645\u0644 GNU OS \u0648GNU Linux \u0631\u0627 \u062a\u0639\u0631\u06cc\u0641 \u0645\u06cc \u06a9\u0646\u062f.\n@informationsec\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0647 \u0637\u0648\u0631 \u0645\u0633\u062a\u0642\u0644 \u062a\u0648\u0633\u0637 \u0645\u062d\u0642\u0642\u0627\u0646 \u062f\u0631 Google \u0648 Red Hat \u06a9\u0634\u0641 \u0634\u062f\u060c Patch \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\u0646\u0642\u0635\u060c CVE-2015-7547\u060c \u06cc\u06a9 \u0633\u0631\u0631\u06cc\u0632 \u0628\u0627\u0641\u0631 \u0645\u0628\u062a\u0646\u06cc \u0628\u0631 \u067e\u0634\u062a\u0647(stack-based buffer overflow) \u062f\u0631 glibc DNS client-side resolver  \u0627\u0633\u062a \u06a9\u0647 \u0645\u0627\u0634\u06cc\u0646 \u0647\u0627\u06cc Linux \u0631\u0627 \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc \u062f\u0647\u062f.\n\u0645\u062a\u062e\u0635\u0635\u06cc\u0646 Google \u062f\u0631 \u0631\u0627\u0647\u0646\u0645\u0627\u06cc\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u062e\u0648\u062f \u06af\u0641\u062a\u0647 \u0627\u0646\u062f \u0646\u0631\u0645 \u0627\u0641\u0632\u0627\u0631\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0627\u0632 \u062a\u0627\u0628\u0639 getaddrinfo () \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u0646\u062f \u0645\u06cc \u062a\u0648\u0627\u0646\u0646\u062f \u062a\u0648\u0633\u0637 domain name\u0647\u0627 \u0648 \u06cc\u0627 DNS servers  \u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0645\u0647\u0627\u062c\u0645 \u0622\u0646\u0647\u0627 \u0631\u0627 \u06a9\u0646\u062a\u0631\u0644 \u0645\u06cc \u06a9\u0646\u0646\u062f \u0648 \u06cc\u0627 \u062d\u0645\u0644\u0647 man-in-the-middle\u060c exploit \u0634\u0648\u0646\u062f.\n@informationsec\n\u0627\u06cc\u0646 \u0645\u0634\u06a9\u0644 \u062f\u0631 \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647 \u0647\u0627\u06cc glibc \u0627\u0632 2.9 \u0628\u0647 \u0628\u0627\u0644\u0627 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f \u0648 \u0628\u0627\u06cc\u0633\u062a\u06cc \u062f\u0631 \u0627\u0633\u0631\u0639 \u0648\u0642\u062a \u0628\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06af\u0631\u062f\u062f.\n\n\u062f\u0631\u0635\u0648\u0631\u062a\u06cc \u06a9\u0647 \u0646\u062a\u0648\u0627\u0646 \u062f\u0631 \u0627\u0633\u0631\u0639 \u0648\u0642\u062a \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627\u06cc \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631 \u0631\u0627 patch \u0646\u0645\u0648\u062f \u0645\u06cc \u062a\u0648\u0627\u0646 \u0627\u0632 \u0631\u0627\u0647\u06a9\u0627\u0631 \u0632\u06cc\u0631 \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u06cc\u06a9 \u0631\u0648\u0634 \u0645\u0648\u0642\u062a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f.\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0645\u062a\u06a9\u06cc \u0628\u0631 \u067e\u0627\u0633\u062e UDP \u06cc\u0627 TCP \u0628\u0632\u0631\u06af (\u0628\u06cc\u0634 \u062a\u0631 \u0627\u0632 2048 \u0628\u0627\u06cc\u062a) \u0627\u0633\u062a \u06a9\u0647 \u067e\u0627\u0633\u062e \u062f\u06cc\u06af\u0631\u06cc \u0631\u0627 \u0628\u0647 \u062f\u0646\u0628\u0627\u0644 \u062e\u0648\u0627\u0647\u062f \u062f\u0627\u0634\u062a \u0648 \u067e\u0634\u062a\u0647 \u0631\u0627 overwrite \u0645\u06cc \u06a9\u0646\u062f. \n\n\u067e\u06cc\u0634\u0646\u0647\u0627\u062f \u0645\u062a\u062e\u0635\u0635\u06cc\u0646 Google\u060c \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062f\u0646 \u0633\u0627\u06cc\u0632 \u067e\u0627\u0633\u062e\u06cc \u06a9\u0647 \u062a\u0648\u0633\u0637 DNS resolver \u067e\u0630\u06cc\u0631\u0641\u062a\u0647 \u0645\u06cc \u0634\u0648\u062f \u0627\u0632 \u0637\u0631\u06cc\u0642 DNSMasq \u06cc\u0627 \u0628\u0631\u0646\u0627\u0645\u0647 \u0647\u0627\u06cc \u0645\u0634\u0627\u0628\u0647 \u060c \u0627\u0633\u062a. \n\u0647\u0645\u0686\u0646\u06cc\u0646 \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u062d\u0627\u0635\u0644 \u06af\u0631\u062f\u062f \u06a9\u0647 DNS query \u0647\u0627 \u0641\u0642\u0637 \u0628\u0647 \u0633\u0631\u0648\u0631\u0647\u0627\u06cc DNS  \u06cc\u06cc \u06a9\u0647  \u0627\u0646\u062f\u0627\u0632\u0647 \u067e\u0627\u0633\u062e UDP  \u0622\u0646\u0647\u0627 \u0628\u0627 truncation bit set \u062a\u0646\u0638\u06cc\u0645 \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\u0627\u0644\u0628\u062a\u0647 \u062f\u0631 \u0645\u0648\u0631\u062f \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062f\u0646 \u0633\u0627\u06cc\u0632 \u0628\u0627\u06cc\u062f \u062f\u0642\u062a \u0628\u06cc\u0634\u062a\u0631\u06cc \u0628\u0647 \u062e\u0631\u062c \u062f\u0627\u062f. \u062f\u0644\u06cc\u0644 \u0627\u06cc\u0646 \u0627\u0645\u0631 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627 \u0627\u0632 \u0627\u0645\u06a9\u0627\u0646\u0627\u062a \u067e\u06cc\u0634\u0631\u0641\u062a\u0647 \u0627\u06cc \u0645\u062b\u0644 DNSSEC \u0627\u0633\u062a \u06a9\u0647 \u0628\u0647 EDNS0  \u0646\u06cc\u0627\u0632 \u062f\u0627\u0631\u062f \u0648 \u0627\u06cc\u0646 \u0648\u06cc\u0698\u06af\u06cc \u0647\u0645 \u0628\u0631\u0627\u06cc \u06a9\u0627\u0631 \u06a9\u0631\u062f \u0635\u062d\u06cc\u062d \u0646\u06cc\u0627\u0632\u0645\u0646\u062f \u067e\u0630\u06cc\u0631\u0634 \u067e\u0627\u0633\u062e \u0647\u0627\u06cc \u0628\u0627\u0644\u0627\u062a\u0631 \u0627\u0632 512 byte  \u062a\u0648\u0633\u0637 \u0633\u0631\u0648\u0631 \u0627\u0633\u062a.\n@informationsec\n\u06af\u0632\u0627\u0631\u0634 Google \u0627\u0634\u0627\u0631\u0647 \u0645\u06cc \u06a9\u0646\u062f \u06a9\u0647 exploitation vector \u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0631\u0627\u06cc \u062d\u0645\u0644\u0647 \u0628\u0647 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0647\u0627 \u0645\u06cc \u062a\u0648\u0627\u0646\u062f \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u062f\u060c ssh\u060c sudo \u0648 curl \u0648 \u0633\u0627\u06cc\u0631 \u0645\u0648\u0627\u0631\u062f \u0627\u0633\u062a.\n\u0647\u0645\u0686\u0646\u06cc\u0646 \u0627\u0634\u0627\u0631\u0647 \u0634\u062f\u0647 \u06a9\u0647 Remote code execution \u0627\u0645\u06a9\u0627\u0646 \u067e\u0630\u06cc\u0631 \u0627\u0633\u062a \u0627\u0645\u0627 \u0633\u0631\u0631\u0627\u0633\u062a(straightforward)  \u0646\u06cc\u0633\u062a. \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u06a9\u0627\u0631 \u0646\u06cc\u0627\u0632 \u0627\u0633\u062a \u0645\u06a9\u0627\u0646\u06cc\u0632\u0645\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0648\u062c\u0648\u062f \u0628\u0631 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627 \u0645\u062b\u0644 ASLR(Address space layout randomization) \u0631\u0627 \u0628\u062a\u0648\u0627\u0646 bypass \u0646\u0645\u0648\u062f.\n\n\u0646\u06af\u0631\u0627\u0646\u06cc \u062f\u0631 \u062e\u0635\u0648\u0635 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0628\u0647 \u062f\u0644\u06cc\u0644 \u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f \u0633\u06cc\u0633\u062a\u0645\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631 \u0627\u0633\u062a \u06a9\u0647 \u062a\u0645\u0627\u0645 \u062a\u062c\u0647\u06cc\u0632\u0627\u062a \u0645\u0628\u062a\u0646\u06cc \u0628\u0631Linux  \u0648 \u0646\u0631\u0645 \u0627\u0641\u0632\u0627\u0631\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0647 \u0646\u0648\u0639\u06cc \u0627\u0632 Glibc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u0646\u062f \u0631\u0627 \u0634\u0627\u0645\u0644 \u0645\u06cc \u0634\u0648\u062f.\n@informationsec\n#\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc_Glibc_2.9 #\u062e\u0628\u0631\n\n\u0645\u0646\u0628\u0639\nhttps://googleonlinesecurity.blogspot.com/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html\nhttps://sourceware.org/ml/libc-alpha/2016-02/msg00416.html\nhttp://www.infoworld.com/article/3033862/security/patch-now-unix-bug-puts-linux-android-and-ios-systems-at-risk.html\nhttps://isc.sans.edu/forums/diary/CVE20157547+Critical+Vulnerability+in+glibc+getaddrinfo/20737\nhttp://www.darknet.org.uk/2016/02/the-linux-glibc-exploit-what-you-need-to-know/", "creation_timestamp": "2026-08-22T14:00:22.244321Z"}, {"uuid": "8118e0a2-c0a1-4782-97de-17fb5c234226", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7547", "type": "seen", "source": "https://t.me/informationsec/692", "content": "\u0645\u0631\u0648\u0631\u06cc \u0628\u0631 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0627\u062e\u06cc\u0631 Glibc\n\n\u0627\u062d\u062a\u0645\u0627\u0644\u0627 \u0647\u0645\u0647 \u062f\u0648\u0633\u062a\u0627\u0646 \u0627\u0632 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0627\u062e\u06cc\u0631\u06cc \u06a9\u0647 \u062f\u0631 Glibc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0622\u06af\u0627\u0647\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646\u062f.  \u0628\u062d\u062b \u0647\u0627\u06cc \u0632\u06cc\u0627\u062f\u06cc \u062f\u0631 \u0627\u06cc\u0646 \u062e\u0635\u0648\u0635 \u062a\u0627 \u06a9\u0646\u0648\u0646 \u062f\u0631 \u0628\u06cc\u0646 \u0645\u062a\u062e\u0635\u0635\u06cc\u0646 \u0645\u0637\u0631\u062d \u0634\u062f\u0647 \u0648 \u0645\u0627 \u0631\u0627 \u0628\u0631 \u0622\u0646 \u062f\u0627\u0634\u062a \u06a9\u0647 \u0628\u0631\u0631\u0633\u06cc \u062f\u0642\u06cc\u0642 \u0648 \u062c\u0627\u0645\u0639 \u062a\u0631\u06cc \u062f\u0631 \u0627\u06cc\u0646 \u062e\u0635\u0648\u0635 \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u06cc\u0645.\n@informationsec\n\u062d\u062f\u0648\u062f \u06cc\u06a9 \u0633\u0627\u0644 \u067e\u06cc\u0634 \u0628\u0648\u062f \u06a9\u0647  glibc\u060c \u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647 GNU C \u060c \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc GHOST  \u0631\u0627 \u062a\u062c\u0631\u0628\u0647 \u06a9\u0631\u062f \u0648 \u0628\u0627\u0632 \u0647\u0645 \u0627\u0645\u0633\u0627\u0644 \u062f\u0631 \u0645\u0639\u0631\u0636 \u06cc\u06a9 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0645\u0647\u0645 \u062f\u06cc\u06af\u0631 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a. \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062a\u0642\u0631\u06cc\u0628\u0627 \u0628\u0631 \u062a\u0645\u0627\u0645 \u0645\u0627\u0634\u06cc\u0646 \u0647\u0627\u06cc \u0645\u0628\u062a\u0646\u06cc \u0628\u0631 Linux\u060c API web services  \u0648 web frameworks  \u0647\u0627\u06cc \u0628\u0632\u0631\u06af\u06cc \u06a9\u0647 \u062f\u0631 \u0622\u0646 \u0627\u06cc\u0646 \u06a9\u062f \u0627\u062c\u0631\u0627 \u0645\u06cc \u0634\u0648\u062f\u060c \u062a\u0623\u062b\u06cc\u0631 \u0645\u06cc \u06af\u0630\u0627\u0631\u062f.\n\n\u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647 Glibc \u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647 C \u06cc\u06cc \u0627\u0633\u062a \u06a9\u0647 systems call \u0647\u0627 \u0648 \u0633\u0627\u06cc\u0631 \u062a\u0648\u0627\u0628\u0639 \u067e\u0627\u06cc\u0647 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627\u06cc Linux \u06cc\u06cc \u0634\u0627\u0645\u0644 GNU OS \u0648GNU Linux \u0631\u0627 \u062a\u0639\u0631\u06cc\u0641 \u0645\u06cc \u06a9\u0646\u062f.\n@informationsec\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0647 \u0637\u0648\u0631 \u0645\u0633\u062a\u0642\u0644 \u062a\u0648\u0633\u0637 \u0645\u062d\u0642\u0642\u0627\u0646 \u062f\u0631 Google \u0648 Red Hat \u06a9\u0634\u0641 \u0634\u062f\u060c Patch \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\u0646\u0642\u0635\u060c CVE-2015-7547\u060c \u06cc\u06a9 \u0633\u0631\u0631\u06cc\u0632 \u0628\u0627\u0641\u0631 \u0645\u0628\u062a\u0646\u06cc \u0628\u0631 \u067e\u0634\u062a\u0647(stack-based buffer overflow) \u062f\u0631 glibc DNS client-side resolver  \u0627\u0633\u062a \u06a9\u0647 \u0645\u0627\u0634\u06cc\u0646 \u0647\u0627\u06cc Linux \u0631\u0627 \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc \u062f\u0647\u062f.\n\u0645\u062a\u062e\u0635\u0635\u06cc\u0646 Google \u062f\u0631 \u0631\u0627\u0647\u0646\u0645\u0627\u06cc\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u062e\u0648\u062f \u06af\u0641\u062a\u0647 \u0627\u0646\u062f \u0646\u0631\u0645 \u0627\u0641\u0632\u0627\u0631\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0627\u0632 \u062a\u0627\u0628\u0639 getaddrinfo () \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u0646\u062f \u0645\u06cc \u062a\u0648\u0627\u0646\u0646\u062f \u062a\u0648\u0633\u0637 domain name\u0647\u0627 \u0648 \u06cc\u0627 DNS servers  \u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0645\u0647\u0627\u062c\u0645 \u0622\u0646\u0647\u0627 \u0631\u0627 \u06a9\u0646\u062a\u0631\u0644 \u0645\u06cc \u06a9\u0646\u0646\u062f \u0648 \u06cc\u0627 \u062d\u0645\u0644\u0647 man-in-the-middle\u060c exploit \u0634\u0648\u0646\u062f.\n@informationsec\n\u0627\u06cc\u0646 \u0645\u0634\u06a9\u0644 \u062f\u0631 \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647 \u0647\u0627\u06cc glibc \u0627\u0632 2.9 \u0628\u0647 \u0628\u0627\u0644\u0627 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f \u0648 \u0628\u0627\u06cc\u0633\u062a\u06cc \u062f\u0631 \u0627\u0633\u0631\u0639 \u0648\u0642\u062a \u0628\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06af\u0631\u062f\u062f.\n\n\u062f\u0631\u0635\u0648\u0631\u062a\u06cc \u06a9\u0647 \u0646\u062a\u0648\u0627\u0646 \u062f\u0631 \u0627\u0633\u0631\u0639 \u0648\u0642\u062a \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627\u06cc \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631 \u0631\u0627 patch \u0646\u0645\u0648\u062f \u0645\u06cc \u062a\u0648\u0627\u0646 \u0627\u0632 \u0631\u0627\u0647\u06a9\u0627\u0631 \u0632\u06cc\u0631 \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u06cc\u06a9 \u0631\u0648\u0634 \u0645\u0648\u0642\u062a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f.\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0645\u062a\u06a9\u06cc \u0628\u0631 \u067e\u0627\u0633\u062e UDP \u06cc\u0627 TCP \u0628\u0632\u0631\u06af (\u0628\u06cc\u0634 \u062a\u0631 \u0627\u0632 2048 \u0628\u0627\u06cc\u062a) \u0627\u0633\u062a \u06a9\u0647 \u067e\u0627\u0633\u062e \u062f\u06cc\u06af\u0631\u06cc \u0631\u0627 \u0628\u0647 \u062f\u0646\u0628\u0627\u0644 \u062e\u0648\u0627\u0647\u062f \u062f\u0627\u0634\u062a \u0648 \u067e\u0634\u062a\u0647 \u0631\u0627 overwrite \u0645\u06cc \u06a9\u0646\u062f. \n\n\u067e\u06cc\u0634\u0646\u0647\u0627\u062f \u0645\u062a\u062e\u0635\u0635\u06cc\u0646 Google\u060c \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062f\u0646 \u0633\u0627\u06cc\u0632 \u067e\u0627\u0633\u062e\u06cc \u06a9\u0647 \u062a\u0648\u0633\u0637 DNS resolver \u067e\u0630\u06cc\u0631\u0641\u062a\u0647 \u0645\u06cc \u0634\u0648\u062f \u0627\u0632 \u0637\u0631\u06cc\u0642 DNSMasq \u06cc\u0627 \u0628\u0631\u0646\u0627\u0645\u0647 \u0647\u0627\u06cc \u0645\u0634\u0627\u0628\u0647 \u060c \u0627\u0633\u062a. \n\u0647\u0645\u0686\u0646\u06cc\u0646 \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u062d\u0627\u0635\u0644 \u06af\u0631\u062f\u062f \u06a9\u0647 DNS query \u0647\u0627 \u0641\u0642\u0637 \u0628\u0647 \u0633\u0631\u0648\u0631\u0647\u0627\u06cc DNS  \u06cc\u06cc \u06a9\u0647  \u0627\u0646\u062f\u0627\u0632\u0647 \u067e\u0627\u0633\u062e UDP  \u0622\u0646\u0647\u0627 \u0628\u0627 truncation bit set \u062a\u0646\u0638\u06cc\u0645 \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\u0627\u0644\u0628\u062a\u0647 \u062f\u0631 \u0645\u0648\u0631\u062f \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062f\u0646 \u0633\u0627\u06cc\u0632 \u0628\u0627\u06cc\u062f \u062f\u0642\u062a \u0628\u06cc\u0634\u062a\u0631\u06cc \u0628\u0647 \u062e\u0631\u062c \u062f\u0627\u062f. \u062f\u0644\u06cc\u0644 \u0627\u06cc\u0646 \u0627\u0645\u0631 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627 \u0627\u0632 \u0627\u0645\u06a9\u0627\u0646\u0627\u062a \u067e\u06cc\u0634\u0631\u0641\u062a\u0647 \u0627\u06cc \u0645\u062b\u0644 DNSSEC \u0627\u0633\u062a \u06a9\u0647 \u0628\u0647 EDNS0  \u0646\u06cc\u0627\u0632 \u062f\u0627\u0631\u062f \u0648 \u0627\u06cc\u0646 \u0648\u06cc\u0698\u06af\u06cc \u0647\u0645 \u0628\u0631\u0627\u06cc \u06a9\u0627\u0631 \u06a9\u0631\u062f \u0635\u062d\u06cc\u062d \u0646\u06cc\u0627\u0632\u0645\u0646\u062f \u067e\u0630\u06cc\u0631\u0634 \u067e\u0627\u0633\u062e \u0647\u0627\u06cc \u0628\u0627\u0644\u0627\u062a\u0631 \u0627\u0632 512 byte  \u062a\u0648\u0633\u0637 \u0633\u0631\u0648\u0631 \u0627\u0633\u062a.\n@informationsec\n\u06af\u0632\u0627\u0631\u0634 Google \u0627\u0634\u0627\u0631\u0647 \u0645\u06cc \u06a9\u0646\u062f \u06a9\u0647 exploitation vector \u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0631\u0627\u06cc \u062d\u0645\u0644\u0647 \u0628\u0647 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0647\u0627 \u0645\u06cc \u062a\u0648\u0627\u0646\u062f \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u062f\u060c ssh\u060c sudo \u0648 curl \u0648 \u0633\u0627\u06cc\u0631 \u0645\u0648\u0627\u0631\u062f \u0627\u0633\u062a.\n\u0647\u0645\u0686\u0646\u06cc\u0646 \u0627\u0634\u0627\u0631\u0647 \u0634\u062f\u0647 \u06a9\u0647 Remote code execution \u0627\u0645\u06a9\u0627\u0646 \u067e\u0630\u06cc\u0631 \u0627\u0633\u062a \u0627\u0645\u0627 \u0633\u0631\u0631\u0627\u0633\u062a(straightforward)  \u0646\u06cc\u0633\u062a. \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u06a9\u0627\u0631 \u0646\u06cc\u0627\u0632 \u0627\u0633\u062a \u0645\u06a9\u0627\u0646\u06cc\u0632\u0645\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0648\u062c\u0648\u062f \u0628\u0631 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627 \u0645\u062b\u0644 ASLR(Address space layout randomization) \u0631\u0627 \u0628\u062a\u0648\u0627\u0646 bypass \u0646\u0645\u0648\u062f.\n\n\u0646\u06af\u0631\u0627\u0646\u06cc \u062f\u0631 \u062e\u0635\u0648\u0635 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0628\u0647 \u062f\u0644\u06cc\u0644 \u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f \u0633\u06cc\u0633\u062a\u0645\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631 \u0627\u0633\u062a \u06a9\u0647 \u062a\u0645\u0627\u0645 \u062a\u062c\u0647\u06cc\u0632\u0627\u062a \u0645\u0628\u062a\u0646\u06cc \u0628\u0631Linux  \u0648 \u0646\u0631\u0645 \u0627\u0641\u0632\u0627\u0631\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0647 \u0646\u0648\u0639\u06cc \u0627\u0632 Glibc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u0646\u062f \u0631\u0627 \u0634\u0627\u0645\u0644 \u0645\u06cc \u0634\u0648\u062f.\n@informationsec\n#\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc_Glibc_2.9 #\u062e\u0628\u0631\n\n\u0645\u0646\u0628\u0639\nhttps://googleonlinesecurity.blogspot.com/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html\nhttps://sourceware.org/ml/libc-alpha/2016-02/msg00416.html\nhttp://www.infoworld.com/article/3033862/security/patch-now-unix-bug-puts-linux-android-and-ios-systems-at-risk.html\nhttps://isc.sans.edu/forums/diary/CVE20157547+Critical+Vulnerability+in+glibc+getaddrinfo/20737\nhttp://www.darknet.org.uk/2016/02/the-linux-glibc-exploit-what-you-need-to-know/", "creation_timestamp": "2026-08-23T00:00:40.431179Z"}, {"uuid": "75646c00-c3a4-4227-be4c-f2044f441722", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7547", "type": "seen", "source": "https://t.me/informationsec/693", "content": "\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062a\u06a9\u0645\u06cc\u0644\u06cc \u062f\u0631 \u062e\u0635\u0648\u0635 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc Glibc \u0648 \u0631\u0648\u0634\u0647\u0627\u06cc Mitigation \u0622\u0646\n\nhttps://sourceware.org/bugzilla/show_bug.cgi?id=18665\n\n- Mitigating factors for UDP include:\n\u00a0 - A firewall that drops UDP DNS packets > 512 bytes.\n\u00a0 - A local resolver (that drops non-compliant responses).\n\u00a0 - Avoid dual A and AAAA queries (avoids buffer management error) e.g.\n\u00a0 \u00a0 Do not use AF_UNSPEC.\n\u00a0 - No use of options edns0 in /etc/resolv.conf since EDNS0 allows\n\u00a0 \u00a0 responses larger than 512 bytes and can lead to valid DNS responses\n\u00a0 \u00a0 that overflow.\n\u00a0 - No use of RES_USE_EDNS0 or RES_USE_DNSSEC since they can both\n\u00a0 \u00a0 lead to valid large EDNS0-based DNS responses that can overflow.\n\n- Mitigating factors for TCP include:\n\u00a0 - Limit all replies to 1024 bytes.\n\n- Mitigations that don't work:\n\u00a0 - Setting options single-request does not change buffer management\n\u00a0 \u00a0 and does not prevent the exploit.\n\u00a0 - Setting options single-request-reopen does not change buffer\n\u00a0 \u00a0 management and does not prevent the exploit.\n\u00a0 - Disabling IPv6 does not disable AAAA queries. The use of AF_UNSPEC\n\u00a0 \u00a0 unconditionally enables the dual query.\n\u00a0 \u00a0 - The use of sysctl -w net.ipv6.conf.all.disable_ipv6=1 will not\n\u00a0 \u00a0 \u00a0 protect your system from the exploit.\n\u00a0 - Blocking IPv6 at a local or intermediate resolver does not work to\n\u00a0 \u00a0 prevent the exploit. The exploit payload can be delivered in A or\n\u00a0 \u00a0 AAAA results, it is the parallel query that triggers the buffer\n\u00a0 \u00a0 management flaw.\n\n\u2796\u2796\u2796\u2796\n@informationsec\n\n\u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc Bind \u0628\u0631\u0627\u06cc truncation bit set(BIND 9 CONFIGURATION REFERENCE)\n\nnamed.conf \ud83d\udc49 options \ud83d\udc49rate-limit \ud83d\udc49 [ slip number ; ]\n\u2796\u2796\u2796\u2796\nDnsmasq\nhttp://www.thekelleys.org.uk/dnsmasq/doc.html\nhttps://wiki.debian.org/HowTo/dnsmasq\n\u2796\u2796\u2796\u2796\nASLR technique\nhttps://en.wikipedia.org/wiki/Address_space_layout_randomization\n\u2796\u2796\u2796\u2796\n@informationsec\n\nRule \u0647\u0627\u06cc \u067e\u06cc\u0634\u0646\u0647\u0627\u062f\u06cc  Mitigate \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062a\u0648\u0633\u0637 snort\nCVE-2015-7547 (GlibC bug) snort rules\nhttp://seclists.org/snort/2016/q1/285\n\u2796\u2796\u2796\u2796\n@informationsec\n\u0648\u0636\u0639\u06cc\u062a \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0648 \u062a\u062c\u0647\u06cc\u0632\u0627\u062a \u0648 \u0645\u062d\u0635\u0648\u0644\u0627\u062a \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631 Cisco\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160218-glibc\n\u2796\u2796\u2796\u2796\n\u0631\u0627\u0647\u06a9\u0627\u0631 \u067e\u06cc\u0634\u0646\u0647\u0627\u062f\u06cc \u0628\u0631\u0627\u06cc Mitigate \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 \u0645\u062d\u0635\u0648\u0644\u0627\u062a Cisco\nCVE-2015-7547, glibc vulnerability; its impact on Cisco products and our mitigation solutions\n\nhttp://info.stack8.com/blog/cve20157547-google-glibc-vulnerability-cisco-products\n\u2796\u2796\u2796\u2796\n\u0648\u0636\u0639\u06cc\u062a \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 Debian\nhttps://security-tracker.debian.org/tracker/CVE-2015-7547\n\u2796\u2796\u2796\u2796\nCVE-2015-7547-poc\nhttps://github.com/fjserna/CVE-2015-7547\n\n@informationsec", "creation_timestamp": "2026-08-23T00:00:40.315883Z"}, {"uuid": "3117f030-7fd3-4d2b-9de4-1bfd919c8f7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7547", "type": "published-proof-of-concept", "source": "https://t.me/informationsec/692", "content": "\u0645\u0631\u0648\u0631\u06cc \u0628\u0631 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0627\u062e\u06cc\u0631 Glibc\n\n\u0627\u062d\u062a\u0645\u0627\u0644\u0627 \u0647\u0645\u0647 \u062f\u0648\u0633\u062a\u0627\u0646 \u0627\u0632 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0627\u062e\u06cc\u0631\u06cc \u06a9\u0647 \u062f\u0631 Glibc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0622\u06af\u0627\u0647\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646\u062f.  \u0628\u062d\u062b \u0647\u0627\u06cc \u0632\u06cc\u0627\u062f\u06cc \u062f\u0631 \u0627\u06cc\u0646 \u062e\u0635\u0648\u0635 \u062a\u0627 \u06a9\u0646\u0648\u0646 \u062f\u0631 \u0628\u06cc\u0646 \u0645\u062a\u062e\u0635\u0635\u06cc\u0646 \u0645\u0637\u0631\u062d \u0634\u062f\u0647 \u0648 \u0645\u0627 \u0631\u0627 \u0628\u0631 \u0622\u0646 \u062f\u0627\u0634\u062a \u06a9\u0647 \u0628\u0631\u0631\u0633\u06cc \u062f\u0642\u06cc\u0642 \u0648 \u062c\u0627\u0645\u0639 \u062a\u0631\u06cc \u062f\u0631 \u0627\u06cc\u0646 \u062e\u0635\u0648\u0635 \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u06cc\u0645.\n@informationsec\n\u062d\u062f\u0648\u062f \u06cc\u06a9 \u0633\u0627\u0644 \u067e\u06cc\u0634 \u0628\u0648\u062f \u06a9\u0647  glibc\u060c \u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647 GNU C \u060c \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc GHOST  \u0631\u0627 \u062a\u062c\u0631\u0628\u0647 \u06a9\u0631\u062f \u0648 \u0628\u0627\u0632 \u0647\u0645 \u0627\u0645\u0633\u0627\u0644 \u062f\u0631 \u0645\u0639\u0631\u0636 \u06cc\u06a9 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0645\u0647\u0645 \u062f\u06cc\u06af\u0631 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a. \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062a\u0642\u0631\u06cc\u0628\u0627 \u0628\u0631 \u062a\u0645\u0627\u0645 \u0645\u0627\u0634\u06cc\u0646 \u0647\u0627\u06cc \u0645\u0628\u062a\u0646\u06cc \u0628\u0631 Linux\u060c API web services  \u0648 web frameworks  \u0647\u0627\u06cc \u0628\u0632\u0631\u06af\u06cc \u06a9\u0647 \u062f\u0631 \u0622\u0646 \u0627\u06cc\u0646 \u06a9\u062f \u0627\u062c\u0631\u0627 \u0645\u06cc \u0634\u0648\u062f\u060c \u062a\u0623\u062b\u06cc\u0631 \u0645\u06cc \u06af\u0630\u0627\u0631\u062f.\n\n\u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647 Glibc \u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647 C \u06cc\u06cc \u0627\u0633\u062a \u06a9\u0647 systems call \u0647\u0627 \u0648 \u0633\u0627\u06cc\u0631 \u062a\u0648\u0627\u0628\u0639 \u067e\u0627\u06cc\u0647 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627\u06cc Linux \u06cc\u06cc \u0634\u0627\u0645\u0644 GNU OS \u0648GNU Linux \u0631\u0627 \u062a\u0639\u0631\u06cc\u0641 \u0645\u06cc \u06a9\u0646\u062f.\n@informationsec\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u06a9\u0647 \u0628\u0647 \u0637\u0648\u0631 \u0645\u0633\u062a\u0642\u0644 \u062a\u0648\u0633\u0637 \u0645\u062d\u0642\u0642\u0627\u0646 \u062f\u0631 Google \u0648 Red Hat \u06a9\u0634\u0641 \u0634\u062f\u060c Patch \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\u0646\u0642\u0635\u060c CVE-2015-7547\u060c \u06cc\u06a9 \u0633\u0631\u0631\u06cc\u0632 \u0628\u0627\u0641\u0631 \u0645\u0628\u062a\u0646\u06cc \u0628\u0631 \u067e\u0634\u062a\u0647(stack-based buffer overflow) \u062f\u0631 glibc DNS client-side resolver  \u0627\u0633\u062a \u06a9\u0647 \u0645\u0627\u0634\u06cc\u0646 \u0647\u0627\u06cc Linux \u0631\u0627 \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc \u062f\u0647\u062f.\n\u0645\u062a\u062e\u0635\u0635\u06cc\u0646 Google \u062f\u0631 \u0631\u0627\u0647\u0646\u0645\u0627\u06cc\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u062e\u0648\u062f \u06af\u0641\u062a\u0647 \u0627\u0646\u062f \u0646\u0631\u0645 \u0627\u0641\u0632\u0627\u0631\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0627\u0632 \u062a\u0627\u0628\u0639 getaddrinfo () \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u0646\u062f \u0645\u06cc \u062a\u0648\u0627\u0646\u0646\u062f \u062a\u0648\u0633\u0637 domain name\u0647\u0627 \u0648 \u06cc\u0627 DNS servers  \u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0645\u0647\u0627\u062c\u0645 \u0622\u0646\u0647\u0627 \u0631\u0627 \u06a9\u0646\u062a\u0631\u0644 \u0645\u06cc \u06a9\u0646\u0646\u062f \u0648 \u06cc\u0627 \u062d\u0645\u0644\u0647 man-in-the-middle\u060c exploit \u0634\u0648\u0646\u062f.\n@informationsec\n\u0627\u06cc\u0646 \u0645\u0634\u06a9\u0644 \u062f\u0631 \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647 \u0647\u0627\u06cc glibc \u0627\u0632 2.9 \u0628\u0647 \u0628\u0627\u0644\u0627 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f \u0648 \u0628\u0627\u06cc\u0633\u062a\u06cc \u062f\u0631 \u0627\u0633\u0631\u0639 \u0648\u0642\u062a \u0628\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06af\u0631\u062f\u062f.\n\n\u062f\u0631\u0635\u0648\u0631\u062a\u06cc \u06a9\u0647 \u0646\u062a\u0648\u0627\u0646 \u062f\u0631 \u0627\u0633\u0631\u0639 \u0648\u0642\u062a \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627\u06cc \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631 \u0631\u0627 patch \u0646\u0645\u0648\u062f \u0645\u06cc \u062a\u0648\u0627\u0646 \u0627\u0632 \u0631\u0627\u0647\u06a9\u0627\u0631 \u0632\u06cc\u0631 \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u06cc\u06a9 \u0631\u0648\u0634 \u0645\u0648\u0642\u062a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f.\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0645\u062a\u06a9\u06cc \u0628\u0631 \u067e\u0627\u0633\u062e UDP \u06cc\u0627 TCP \u0628\u0632\u0631\u06af (\u0628\u06cc\u0634 \u062a\u0631 \u0627\u0632 2048 \u0628\u0627\u06cc\u062a) \u0627\u0633\u062a \u06a9\u0647 \u067e\u0627\u0633\u062e \u062f\u06cc\u06af\u0631\u06cc \u0631\u0627 \u0628\u0647 \u062f\u0646\u0628\u0627\u0644 \u062e\u0648\u0627\u0647\u062f \u062f\u0627\u0634\u062a \u0648 \u067e\u0634\u062a\u0647 \u0631\u0627 overwrite \u0645\u06cc \u06a9\u0646\u062f. \n\n\u067e\u06cc\u0634\u0646\u0647\u0627\u062f \u0645\u062a\u062e\u0635\u0635\u06cc\u0646 Google\u060c \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062f\u0646 \u0633\u0627\u06cc\u0632 \u067e\u0627\u0633\u062e\u06cc \u06a9\u0647 \u062a\u0648\u0633\u0637 DNS resolver \u067e\u0630\u06cc\u0631\u0641\u062a\u0647 \u0645\u06cc \u0634\u0648\u062f \u0627\u0632 \u0637\u0631\u06cc\u0642 DNSMasq \u06cc\u0627 \u0628\u0631\u0646\u0627\u0645\u0647 \u0647\u0627\u06cc \u0645\u0634\u0627\u0628\u0647 \u060c \u0627\u0633\u062a. \n\u0647\u0645\u0686\u0646\u06cc\u0646 \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u062d\u0627\u0635\u0644 \u06af\u0631\u062f\u062f \u06a9\u0647 DNS query \u0647\u0627 \u0641\u0642\u0637 \u0628\u0647 \u0633\u0631\u0648\u0631\u0647\u0627\u06cc DNS  \u06cc\u06cc \u06a9\u0647  \u0627\u0646\u062f\u0627\u0632\u0647 \u067e\u0627\u0633\u062e UDP  \u0622\u0646\u0647\u0627 \u0628\u0627 truncation bit set \u062a\u0646\u0638\u06cc\u0645 \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\u0627\u0644\u0628\u062a\u0647 \u062f\u0631 \u0645\u0648\u0631\u062f \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062f\u0646 \u0633\u0627\u06cc\u0632 \u0628\u0627\u06cc\u062f \u062f\u0642\u062a \u0628\u06cc\u0634\u062a\u0631\u06cc \u0628\u0647 \u062e\u0631\u062c \u062f\u0627\u062f. \u062f\u0644\u06cc\u0644 \u0627\u06cc\u0646 \u0627\u0645\u0631 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627 \u0627\u0632 \u0627\u0645\u06a9\u0627\u0646\u0627\u062a \u067e\u06cc\u0634\u0631\u0641\u062a\u0647 \u0627\u06cc \u0645\u062b\u0644 DNSSEC \u0627\u0633\u062a \u06a9\u0647 \u0628\u0647 EDNS0  \u0646\u06cc\u0627\u0632 \u062f\u0627\u0631\u062f \u0648 \u0627\u06cc\u0646 \u0648\u06cc\u0698\u06af\u06cc \u0647\u0645 \u0628\u0631\u0627\u06cc \u06a9\u0627\u0631 \u06a9\u0631\u062f \u0635\u062d\u06cc\u062d \u0646\u06cc\u0627\u0632\u0645\u0646\u062f \u067e\u0630\u06cc\u0631\u0634 \u067e\u0627\u0633\u062e \u0647\u0627\u06cc \u0628\u0627\u0644\u0627\u062a\u0631 \u0627\u0632 512 byte  \u062a\u0648\u0633\u0637 \u0633\u0631\u0648\u0631 \u0627\u0633\u062a.\n@informationsec\n\u06af\u0632\u0627\u0631\u0634 Google \u0627\u0634\u0627\u0631\u0647 \u0645\u06cc \u06a9\u0646\u062f \u06a9\u0647 exploitation vector \u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0631\u0627\u06cc \u062d\u0645\u0644\u0647 \u0628\u0647 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0647\u0627 \u0645\u06cc \u062a\u0648\u0627\u0646\u062f \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u062f\u060c ssh\u060c sudo \u0648 curl \u0648 \u0633\u0627\u06cc\u0631 \u0645\u0648\u0627\u0631\u062f \u0627\u0633\u062a.\n\u0647\u0645\u0686\u0646\u06cc\u0646 \u0627\u0634\u0627\u0631\u0647 \u0634\u062f\u0647 \u06a9\u0647 Remote code execution \u0627\u0645\u06a9\u0627\u0646 \u067e\u0630\u06cc\u0631 \u0627\u0633\u062a \u0627\u0645\u0627 \u0633\u0631\u0631\u0627\u0633\u062a(straightforward)  \u0646\u06cc\u0633\u062a. \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u06a9\u0627\u0631 \u0646\u06cc\u0627\u0632 \u0627\u0633\u062a \u0645\u06a9\u0627\u0646\u06cc\u0632\u0645\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0648\u062c\u0648\u062f \u0628\u0631 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627 \u0645\u062b\u0644 ASLR(Address space layout randomization) \u0631\u0627 \u0628\u062a\u0648\u0627\u0646 bypass \u0646\u0645\u0648\u062f.\n\n\u0646\u06af\u0631\u0627\u0646\u06cc \u062f\u0631 \u062e\u0635\u0648\u0635 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0628\u0647 \u062f\u0644\u06cc\u0644 \u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f \u0633\u06cc\u0633\u062a\u0645\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631 \u0627\u0633\u062a \u06a9\u0647 \u062a\u0645\u0627\u0645 \u062a\u062c\u0647\u06cc\u0632\u0627\u062a \u0645\u0628\u062a\u0646\u06cc \u0628\u0631Linux  \u0648 \u0646\u0631\u0645 \u0627\u0641\u0632\u0627\u0631\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0647 \u0646\u0648\u0639\u06cc \u0627\u0632 Glibc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u0646\u062f \u0631\u0627 \u0634\u0627\u0645\u0644 \u0645\u06cc \u0634\u0648\u062f.\n@informationsec\n#\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc_Glibc_2.9 #\u062e\u0628\u0631\n\n\u0645\u0646\u0628\u0639\nhttps://googleonlinesecurity.blogspot.com/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html\nhttps://sourceware.org/ml/libc-alpha/2016-02/msg00416.html\nhttp://www.infoworld.com/article/3033862/security/patch-now-unix-bug-puts-linux-android-and-ios-systems-at-risk.html\nhttps://isc.sans.edu/forums/diary/CVE20157547+Critical+Vulnerability+in+glibc+getaddrinfo/20737\nhttp://www.darknet.org.uk/2016/02/the-linux-glibc-exploit-what-you-need-to-know/", "creation_timestamp": "2026-08-24T00:00:08.327591Z"}, {"uuid": "7f6cb01a-1930-4041-af12-67b3979ab034", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-7547", "type": "published-proof-of-concept", "source": "https://t.me/informationsec/693", "content": "\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062a\u06a9\u0645\u06cc\u0644\u06cc \u062f\u0631 \u062e\u0635\u0648\u0635 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc Glibc \u0648 \u0631\u0648\u0634\u0647\u0627\u06cc Mitigation \u0622\u0646\n\nhttps://sourceware.org/bugzilla/show_bug.cgi?id=18665\n\n- Mitigating factors for UDP include:\n\u00a0 - A firewall that drops UDP DNS packets > 512 bytes.\n\u00a0 - A local resolver (that drops non-compliant responses).\n\u00a0 - Avoid dual A and AAAA queries (avoids buffer management error) e.g.\n\u00a0 \u00a0 Do not use AF_UNSPEC.\n\u00a0 - No use of options edns0 in /etc/resolv.conf since EDNS0 allows\n\u00a0 \u00a0 responses larger than 512 bytes and can lead to valid DNS responses\n\u00a0 \u00a0 that overflow.\n\u00a0 - No use of RES_USE_EDNS0 or RES_USE_DNSSEC since they can both\n\u00a0 \u00a0 lead to valid large EDNS0-based DNS responses that can overflow.\n\n- Mitigating factors for TCP include:\n\u00a0 - Limit all replies to 1024 bytes.\n\n- Mitigations that don't work:\n\u00a0 - Setting options single-request does not change buffer management\n\u00a0 \u00a0 and does not prevent the exploit.\n\u00a0 - Setting options single-request-reopen does not change buffer\n\u00a0 \u00a0 management and does not prevent the exploit.\n\u00a0 - Disabling IPv6 does not disable AAAA queries. The use of AF_UNSPEC\n\u00a0 \u00a0 unconditionally enables the dual query.\n\u00a0 \u00a0 - The use of sysctl -w net.ipv6.conf.all.disable_ipv6=1 will not\n\u00a0 \u00a0 \u00a0 protect your system from the exploit.\n\u00a0 - Blocking IPv6 at a local or intermediate resolver does not work to\n\u00a0 \u00a0 prevent the exploit. The exploit payload can be delivered in A or\n\u00a0 \u00a0 AAAA results, it is the parallel query that triggers the buffer\n\u00a0 \u00a0 management flaw.\n\n\u2796\u2796\u2796\u2796\n@informationsec\n\n\u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc Bind \u0628\u0631\u0627\u06cc truncation bit set(BIND 9 CONFIGURATION REFERENCE)\n\nnamed.conf \ud83d\udc49 options \ud83d\udc49rate-limit \ud83d\udc49 [ slip number ; ]\n\u2796\u2796\u2796\u2796\nDnsmasq\nhttp://www.thekelleys.org.uk/dnsmasq/doc.html\nhttps://wiki.debian.org/HowTo/dnsmasq\n\u2796\u2796\u2796\u2796\nASLR technique\nhttps://en.wikipedia.org/wiki/Address_space_layout_randomization\n\u2796\u2796\u2796\u2796\n@informationsec\n\nRule \u0647\u0627\u06cc \u067e\u06cc\u0634\u0646\u0647\u0627\u062f\u06cc  Mitigate \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062a\u0648\u0633\u0637 snort\nCVE-2015-7547 (GlibC bug) snort rules\nhttp://seclists.org/snort/2016/q1/285\n\u2796\u2796\u2796\u2796\n@informationsec\n\u0648\u0636\u0639\u06cc\u062a \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0648 \u062a\u062c\u0647\u06cc\u0632\u0627\u062a \u0648 \u0645\u062d\u0635\u0648\u0644\u0627\u062a \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631 Cisco\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160218-glibc\n\u2796\u2796\u2796\u2796\n\u0631\u0627\u0647\u06a9\u0627\u0631 \u067e\u06cc\u0634\u0646\u0647\u0627\u062f\u06cc \u0628\u0631\u0627\u06cc Mitigate \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 \u0645\u062d\u0635\u0648\u0644\u0627\u062a Cisco\nCVE-2015-7547, glibc vulnerability; its impact on Cisco products and our mitigation solutions\n\nhttp://info.stack8.com/blog/cve20157547-google-glibc-vulnerability-cisco-products\n\u2796\u2796\u2796\u2796\n\u0648\u0636\u0639\u06cc\u062a \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 Debian\nhttps://security-tracker.debian.org/tracker/CVE-2015-7547\n\u2796\u2796\u2796\u2796\nCVE-2015-7547-poc\nhttps://github.com/fjserna/CVE-2015-7547\n\n@informationsec", "creation_timestamp": "2026-08-24T00:00:08.459802Z"}]}