We are currently working on and testing errata for RHEL 4, we will post an update for it as soon as it's ready. Thank you for your patience!

The GHOST-test.sh script appears not to work properly? I've checked a system that the script says is NOT vulnerable, but yet the security errata is still applicable.

Version of glibc installed: 2.5-123
Version provided by the errata: 2.5-123.el5_11.1

We are currently using RHEL 5.7 and 6.3 and using glibc-2.12-1.132.el6_5.4 for 6.3 and glibc-2.5-118.el5_10.3 for 5.7. We would like to confirm is it must restart the system after apply this errata in our environment? thanks.

Dear All,

Something is not good here. Red Hat claims that they fixed the issue with this errata: https://rhn.redhat.com/errata/RHSA-2015-0092.html (glibc-2.12-1.149.el6_6.5.x86_64.rpm) but some tester still says that my WS is vulnerable.

The suggestion is to check your systems with the GHOST-test.sh script. That script does not do anything but checks your glibc version:

$ /tmp/GHOST-test.sh 
Vulnerable glibc version <= 2.17-54
Vulnerable glibc version <= 2.5-122
Vulnerable glibc version <= 2.12-1.148
Detected glibc version 2.12 revision 149
Not Vulnerable.

BUT, it seems my RH is still vulnerable and I can prove it with the following two method (which tries to use the sec hole itself and not only tests the glibc version):
1)

# /usr/sbin/clockdiff `python -c "print '0' * $((0x10000-16*1-2*4-1-4))"`
Segmentation fault

2)

# cat /tmp/GHOST.c 
#include <netdb.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>

#define CANARY "in_the_coal_mine"

struct {
  char buffer[1024];
  char canary[sizeof(CANARY)];
} temp = { "buffer", CANARY };

int main(void) {
  struct hostent resbuf;
  struct hostent *result;
  int herrno;
  int retval;

  /*** strlen (name) = size_needed - sizeof (*host_addr) - sizeof (*h_addr_ptrs) - 1; ***/
  size_t len = sizeof(temp.buffer) - 16*sizeof(unsigned char) - 2*sizeof(char *) - 1;
  char name[sizeof(temp.buffer)];
  memset(name, '0', len);
  name[len] = '\0';

  retval = gethostbyname_r(name, &resbuf, temp.buffer, sizeof(temp.buffer), &result, &herrno);

  if (strcmp(temp.canary, CANARY) != 0) {
    puts("vulnerable");
    exit(EXIT_SUCCESS);
  }
  if (retval == ERANGE) {
    puts("not vulnerable");
    exit(EXIT_SUCCESS);
  }
  puts("should not happen");
  exit(EXIT_FAILURE);
}

# gcc -o /tmp/ghost /tmp/GHOST.c 
# /tmp/ghost 
vulnerable

So, did Red Hat fixed this?

Bullet 1 contains "1.Update the glibc and ncsd packages" shouldn't this be: glibc and NSCD?

On RHEL 5.11 the GHOST-test.sh script incorrectly reports the system as Not Vulnerable if you have glibc-2.5-123 installed rather than glibc-2.5-123.el5_11.1.

i.e.:

[root@uos-t-rhtm-07 install]# ./GHOST-test.sh
Vulnerable glibc version <= 2.17-54
Vulnerable glibc version <= 2.5-122
Vulnerable glibc version <= 2.12-1.148
Detected glibc version 2.5 revision 123
Not Vulnerable.
[root@uos-t-rhtm-07 install]# rpm -qa glibc
glibc-2.5-123
glibc-2.5-123
[root@uos-t-rhtm-07 install]# ./GHOST
vulnerable

Please can this be checked so people know whether they should patch or not.

Thanks.

TG

What about the compat-glibc packages? I would assume they are also vulnerable?

For you information we are using glibc-2.12-1.132.el6.x86_64.rpm version in redhat 6.5 servers.

Looks like the page at https://access.redhat.com/labs/ghost/ that had the link to the test script has been pulled. Now it produces a 404 error.

Charlie D.

I'm experiencing the same issues after patching. Script appears to report vulnerable after installing the proper Errata.

Updates are published for the current active minor releases 7.0, 6.6, 5.11. For prior minor releases, you typically need an entitlement for Extended Update Support. Without that, you may not be able to download it.

Thanks, it seems to be working now.

./ghost.sh
Installed glibc version(s)
- glibc-2.5-123.x86_64: vulnerable
- glibc-2.5-123.i686: vulnerable

This system is vulnerable to CVE-2015-0235. https://access.redhat.com/security/cve/CVE-2015-0235
Please refer to https://access.redhat.com/articles/1332213 for remediation steps
[root@ld2 Ghost]# rpm -qi glibc
Name : glibc Relocations: (not relocatable)
Version : 2.5 Vendor: Red Hat, Inc.
Release : 123 Build Date: Tue 26 Aug 2014 12:02:48 PM CDT
Install Date: Tue 14 Oct 2014 11:52:46 AM CDT Build Host: x86-027.build.eng.bos.redhat.com
Group : System Environment/Libraries Source RPM: glibc-2.5-123.src.rpm
Size : 11690192 License: LGPL
Signature : DSA/SHA1, Wed 27 Aug 2014 04:17:14 AM CDT, Key ID 5326810137017186
Packager : Red Hat, Inc. http://bugzilla.redhat.com/bugzilla
Summary : The GNU libc libraries.
Description :
The glibc package contains standard libraries which are used by
multiple programs on the system. In order to save disk space and
memory, as well as to make upgrading easier, common system code is
kept in one place and shared between programs. This particular package
contains the most important sets of shared libraries: the standard C
library and the standard math library. Without these two libraries, a
Linux system will not function.
Name : glibc Relocations: (not relocatable)
Version : 2.5 Vendor: Red Hat, Inc.
Release : 123 Build Date: Tue 26 Aug 2014 12:17:01 PM CDT
Install Date: Tue 14 Oct 2014 11:54:21 AM CDT Build Host: x86-002.build.bos.redhat.com
Group : System Environment/Libraries Source RPM: glibc-2.5-123.src.rpm
Size : 13032544 License: LGPL
Signature : DSA/SHA1, Wed 27 Aug 2014 04:17:14 AM CDT, Key ID 5326810137017186
Packager : Red Hat, Inc. http://bugzilla.redhat.com/bugzilla
Summary : The GNU libc libraries.
Description :
The glibc package contains standard libraries which are used by
multiple programs on the system. In order to save disk space and
memory, as well as to make upgrading easier, common system code is
kept in one place and shared between programs. This particular package
contains the most important sets of shared libraries: the standard C
library and the standard math library. Without these two libraries, a
Linux system will not function.
2015-0235)" = $(rpm -q glibc | wc -l) && echo ok || echo 'not ok' | grep -c CVE-
not ok

#

I don't want to update repository..Can somebody give a download and install solution manually

Can you please confirm that a reboot is completely necessary to close this vulnerability? We have a very large environment so do not wish to be rebooting unless its completely necessary.

All, Is it better to have a shell script that checks a version number or a binary that actually attempts the exposure?
Might be fodder for exploit-kiddies, but the mere version check involves trust, and the compiled binary confirms the remediation.

$,02222222,,,