Can the latest glibc DNS vuln be tested on remote servers?

Question

I recently heard of the critical DNS vulnerability in glibc that can lead to arbitrary code execution. I hadn't found much about the cases when the faulty function is called and ways to remotely diagnose the vulnerability - what could be an example scenario that determines whether a given target isn't patched yet?

Answer 1

Since the attack needs the client to first make a DNS request you need some way to trigger this request. If this can be done remotely depends on the server setup and applications running. But if you have access to the server you can try the PoC from google.

Please not that failure of the PoC indicates only that the server is probably not affected but you cannot be fully sure. There might be binaries on the system which contain a statically linked libc and are thus not fixed by upgrading the system libc.