GHOST: glibc vulnerability (CVE-2015-0235)

Latest response

Hi,

A critical security vulnerability has been discovered in glibc code. Potentially, a remote exploit is possible. It affects all versions of glibc shipped with all versions and variants of Red Hat Enterprise Linux. Updated packages that fix the problem are available. All users are advised to update.

Please, see the following KB article for more detailed information (incl. links to respective errata). Red Hat has also prepared a lab for testing whether your system is vulnerable:

Robert Krátký's picture
Log in to join the conversation

Responses

PS Guru 6494 points
27 January 2015 9:44 PM

Robert,

Can you advise if SELinux provides any level of mitigation by constraining the access of the exploited service/user?

I appreciate this isn't a fix, but interested to know how far SELinux goes in limiting the impact of this exploit (is this tested in the lab?).

Robert Krátký's picture Red Hat Guru 3240 points
28 January 2015 1:01 PM

Hi Pixel,

I'll investigate about SELinux. The detection script DOES NOT test for that. That said, the script had some deficiencies, so it's now being rewritten. I'll update this discussion when it's ready for use again.

Robert Krátký's picture Red Hat Guru 3240 points
28 January 2015 4:48 PM

The detection script has been fixed, and the lab is available again: GHOST - gethostbyname Detector.

Please note that it only checks whether the glibc package has been updated (or is already new enough not to contain the bug). It does not check for actual exploitability.

GN Newbie 5 points
28 January 2015 4:29 AM

Has the RHEL-6 patch been released for Satellite ? We can't see it only for RHEL-5.

ir. Jan Gerrit Kootstra's picture Guru 6222 points
28 January 2015 6:39 AM

My Satellite received the patch last night, for running the test script on it's hypervisor (KVM) showed the server was patched.

MS Community Member 38 points
30 January 2015 4:15 PM

I'm just curious that the new Ghost test script, fails on my verson 5, but not version six, yet the old test script after patching to glibc 2.5.123, (an upgrade from 2.5.117) says it's not vulnerable, so I'm confused....is the version 3 Ghost detection script for all versions?

Robert Krátký's picture Red Hat Guru 3240 points
30 January 2015 4:18 PM

Hi,

Yes, the new script (v. 3 and up) should work on all versions. Please, disregard the old script -- it was faulty and gave false negatives.

MS Community Member 38 points
30 January 2015 4:25 PM

Thanks Robert, so based on that I have to update my kernel to go to 5_11? I'm running 5_10 kernel 391, and the RHSA 2015-090-1 lists glibc-2.5-123.el5_11.1.x86_64.rpm, I'm taking that the el5_11.1 is for 5_11 kernel 398 and higher, is that correct. So there is no patch for 5_10, kernel 391? Sorry I'm new at this.

Robert Krátký's picture Red Hat Guru 3240 points
1 February 2015 2:42 PM

Yes, you should update to RHEL 5.11 -- the latest 5 version. Fixed glibc packages are available for 5.11, 5.9.z (EUS), and 5.6 (long life).

IS Community Member 30 points
2 February 2015 5:34 PM

What is the actual command to patch GHOST in REDHAT 6.4? Iam wanting to stay in RHELV6. Is "yum update glibc" correct?

ir. Jan Gerrit Kootstra's picture Guru 6222 points
2 February 2015 8:06 PM

Internal Support,

hmmm confusing name.

yum update glibc nscd

Kind regards,

Jan Gerrit

james.radtke@siriusxm.com's picture Guru 6863 points
2 February 2015 8:19 PM

Hey Jan - do you know if you have to specify glibc-* (or does glibc by itself grab all the other files)?

ir. Jan Gerrit Kootstra's picture Guru 6222 points
2 February 2015 9:11 PM

Hey James,

My command is more then enough.

yum update nscd
would be sufficient for those of us using it.

I just installed nscd on a test machine and it automatically forced a glibc-* update

Kind regards,

Jan Gerrit

IS Community Member 30 points
2 February 2015 8:20 PM

Thank you,

-Joseph

oa Newbie 10 points
13 February 2015 6:14 PM

script is not working for me, when was the last time it was updated? Running version 6.

Robert Krátký's picture Red Hat Guru 3240 points
14 February 2015 3:39 PM

Hi Debbie,

Could you please provide more information? What do you mean when you say it's 'not working'? Could you post the output of the script?

oa Newbie 10 points
18 February 2015 3:49 PM

I downloaded script and it did not work, but I found other ways to detect library version. I was able to use the other script to detect vulnerability. Thanks

Robert Krátký's picture Red Hat Guru 3240 points
18 February 2015 7:29 PM

Hi Debbie,

I'm not sure to what other script you refer -- Red Hat only provides one detection script. If the script provided by Red Hat (linked from the first post in this discussion) does not work, we would appreciate it if you could provide us with more details, so that it can be fixed.

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.