GHOST (CVE-2015-0235) - gethostbyname Detector

This script appears to be broken. It does not check the Release version numbers correctly across all versions of RHEL server. Thus, it marks unpatched hosts as patched (RHEL7 & RHEL5) while marking RHEL6 hosts as vulnerable.
e.g.
RHEL7:
Version : 2.17
Release : 55.el7_0.3
is marked as patched when in fact only version 55.el7_05 is patched. The script only checks for the presence of "55".

You should mention, that the script does not "test if system is vulnerable" but only "test if system has a known bad version of libc".

why not?

[root@localhost ~]# rpm -qa glibc
glibc-2.12-1.149.el6_6.5.x86_64 <== patch version?

[root@localhost ~]# ./GHOST-test.sh
Vulnerable glibc version <= 2.17-54
Vulnerable glibc version <= 2.5-122
Detected glibc version 2.12-1
This system is vulnerable to CVE-2015-0235. https://access.redhat.com/security/cve/CVE-2015-0235
Please refer to https://access.redhat.com/articles/1332213 for remediation steps
[root@localhost ~]#

glibc_version=$(rpm -q glibc | awk -F"[-.]" '{print $2"."$3}' | sort -u)
glibc_revision=$(rpm -q glibc | awk -F"[-.]" '{print $4}' | sort -u) <== miss version check?

Can we count on this script? Looks like system with existing updates are not affected.

This is so broken...
Having a script that informs you that all is swell is worse than having no script at all.
You need to take down this script ASAP until you can find a proper fix for it.

This patch fixes the script for us, EL5/6/7

--- GHOST-test.sh   2015-01-28 08:42:07.816793000 +0100
+++ REAL-GHOST-test.sh  2015-01-28 08:42:01.201186000 +0100
@@ -31,23 +31,33 @@
 }

 glibc_vulnerable_version=2.17
-glibc_vulnerable_revision=54
+glibc_vulnerable_revision=55
+glibc_vulnerable_minor=0.4
+
 glibc_vulnerable_version2=2.5
-glibc_vulnerable_revision2=122
+glibc_vulnerable_revision2=123
+glibc_vulnerable_minor2=11.0
+
 glibc_vulnerable_version3=2.12
-glibc_vulnerable_revision3=148
-echo "Vulnerable glibc version <=" $glibc_vulnerable_version"-"$glibc_vulnerable_revision
-echo "Vulnerable glibc version <=" $glibc_vulnerable_version2"-"$glibc_vulnerable_revision2
-echo "Vulnerable glibc version <=" $glibc_vulnerable_version3"-1."$glibc_vulnerable_revision3
+glibc_vulnerable_revision3=149
+glibc_vulnerable_minor3=6.4
+
+echo "Vulnerable glibc version <=" $glibc_vulnerable_version"-"$glibc_vulnerable_revision"-"$glibc_vulnerable_minor
+echo "Vulnerable glibc version <=" $glibc_vulnerable_version2"-"$glibc_vulnerable_revision2"."$glibc_vulnerable_minor2
+echo "Vulnerable glibc version <=" $glibc_vulnerable_version3"-1."$glibc_vulnerable_revision3"."$glibc_vulnerable_minor3

 glibc_version=$(rpm -q glibc | awk -F"[-.]" '{print $2"."$3}' | sort -u)
 if [[ $glibc_version == $glibc_vulnerable_version3 ]]
 then
     glibc_revision=$(rpm -q glibc | awk -F"[-.]" '{print $5}' | sort -u)
+    glibc_minor=$(rpm -q glibc | awk -F"[-._]" '{print $7"."$8}' | sort -u)
+
 else
+    glibc_minor=$(rpm -q glibc | awk -F"[-._]" '{print $6"."$7}' | sort -u)
     glibc_revision=$(rpm -q glibc | awk -F"[-.]" '{print $4}' | sort -u)
 fi
-echo "Detected glibc version" $glibc_version" revision "$glibc_revision
+
+echo "Detected glibc version" $glibc_version" revision "$glibc_revision" minor "$glibc_minor

 vulnerable_text=$"This system is vulnerable to CVE-2015-0235. <https://access.redhat.com/security/cve/CVE-2015-0235>
 Please refer to <https://access.redhat.com/articles/1332213> for remediation steps"
@@ -55,16 +65,30 @@
 if [[ $glibc_version == $glibc_vulnerable_version ]]
 then
     vercomp $glibc_vulnerable_revision $glibc_revision
+    case $? in
+   0) vercomp $glibc_vulnerable_minor $glibc_minor;;
+   1) vercomp $glibc_vulnerable_minor $glibc_minor;;
+    esac
 elif [[ $glibc_version == $glibc_vulnerable_version2 ]]
 then
     vercomp $glibc_vulnerable_revision2 $glibc_revision
+    case $? in
+   0) vercomp $glibc_vulnerable_minor2 $glibc_minor;;
+   1) vercomp $glibc_vulnerable_minor2 $glibc_minor;;
+    esac
 elif [[ $glibc_version == $glibc_vulnerable_version3 ]]
 then
     vercomp $glibc_vulnerable_revision3 $glibc_revision
+    case $? in
+   0) vercomp $glibc_vulnerable_minor3 $glibc_minor;;
+   1) vercomp $glibc_vulnerable_minor3 $glibc_minor;;
+    esac
+
 else
     vercomp $glibc_vulnerable_version $glibc_version
 fi

+
 case $? in
     0) echo "$vulnerable_text";;
     1) echo "$vulnerable_text";;

Hi,

We execute script GHOST-test.sh in several of my system.
The output is "Not vulnerable".
However we execute a C program from https://www.qualys.com/research/security-advisories/GHOST-CVE-2015-0235.txt

The output of this program is "vulnerable".

Sytems:
RHEL 6.6 and kernel 2.6.32-504.1.3.el6.x86_64
GHOST-test.sh output:
Detected glibc version 2.12 revision 149
Not Vulnerable.

Which of those tests are ok?

Regards

Does not work for RHEL 4 as the extended support rpms do not appear to have the CVE-2015-0235 tag in the change log