Glibc Vulnerability - (Ghost) on Centos

[Bob1]

Vulnerability announced in the last few days to do with Glibc

Technical data
http://cve.mitre.org/cgi-bin/cvename.cg ... -2015-0235
and
http://lists.centos.org/pipermail/cento ... 20906.html

Site with plain english and test script
http://www.cyberciti.biz/faq/cve-2015-0 ... hel-linux/

Still early days - but appears that Centos has released a update to glibc, so I suspect a yum update glibc will correct this vulnerability, however not sure what impact it may have on the Elastix system - need to test with test systems first - this patch HAS NOT been tested yet.

Regards

Bob

 

[milocheri]

Tested in a Production server running yum update glibc with no problem, Thanks for the Info Bob!

Edit:
After upgrade, reboot, and run rpm -q --changelog glibc | grep CVE-2015-0235 just to make sure that the issue is solved !

 

[Bob1]

milocheri,

Thank you for the update - appreciated...

Will test with several versions that I have here...

Can you confirm what Elastix version you have tested against???

Regards

Bob

 

[Bob1]

Ok have completed a check against a Elastix 2.4 & 2.5 production system.

I performed a

yum update glibc

on both systems and rebooted both systems (this is important).

Once completed a run through a series of sanity checks e.g. Web pages working under Elastix, under Freepbx etc...

Finally I jumped in via SSH and performed the following command

This gets a script that tests for the Vulnerability

wget https://webshare.uchicago.edu/orgs/ITServices/itsec/Downloads/GHOST.c -O ghost.c

once the file ghost.c is downloaded, we need to compile it (gcc is already on your Elastix system) using the following command

gcc -o ghost ghost.c

This will create a executable file called ghost which we run with the following command

./ghost

If it runs ok it should show similar on the screen

[root@elastix25 ~]# ./ghost
not vulnerable



Now it worked ok on the systems that I tested it on....these are standard systems
Whilst it is expected it will have no impact performing the update, I cannot guarantee it.......

Before you proceed, make sure that you have a good backup....repeat...a good backup...

Otherwise wait for a while for others to perform the update, that have trusted rollback and backup measures in place....

Regards

Bob

 

[klept24]

Hi,

So basically there is no need to update the whole system like im having elastix 2.4 installed im planning to upgrade it to elastix 2.5. or just like the test you did. updating the glibc will be safe.

 

[danardf]

Vulnerability announced in the last few days to do with Glibc
.../...

Hi Bob.

Thanks Bob for this alert.

 

[Bob1]

klept24,

thats correct just update glibc....it will install/update a few dependencies, but thats it....

However, as I said, i cannot guarantee what worked for me will work for you...so make sure you have backups...

Regards

Bob