System Security
Denjello PublicSeen by 32There is a new exploit coming down the pipes, and they are calling it Ghost. It is a VERY old bug in libc6 (glibc) and it is a problem because it is used to compile many programs, and just updating it in and of itself isn't enough. You would need to update or recompile lots of other programs. I thought I would start this discussion to see how the other devs are holding up.
Is your linux affected by Ghost?
proposal by Denjello Closed Mon 27 Feb 2017 9:59PM
show programs compiled with libc:
# lsof | grep libc | awk '{print $1}' | sort | uniq
find version of libc6:
# aptitude show libc6
VULNERABLE:
Ubuntu 14.04 is installed
AND libc6 is earlier than 0:2.19-0ubuntu6.4
Ubuntu 12.04 is installed
AND libc6 is earlier than 0:2.15-0ubuntu10.9
Debian wheezy is installed
AND glibc is earlier than 2.13-38+deb7u7
Debian jessie, sid is installed
AND glibc is earlier than 2.18-1
Results
| Results | Option | Votes | % of votes cast | % of eligible voters | |
|---|---|---|---|---|---|
| Agree | 0 | 0 | 0 | ||
| Abstain | 0 | 0 | 0 | ||
| Disagree | 1 | 100 | 1 | | |
| Block | 0 | 0 | 0 | ||
| Not voted | 137 | 99 |           |
Nope, not affected on any of my machines. What's the hype about?
Most binaries are dynamically linked, so you can just upgrade glibc (and glibc-dev, glic-bin, or whatever related packages your system has). Install the security updates from your vendor. It might be worth a reboot, or at least restarting running daemon processes after updating libc.
binaries that statically link glibc will need to be updated separately. These are usually ones that are designed for extreme stability, or to fit in small places. e.g. a lot of the basic stuff in /bin and /sbin on a typical linux distribution, or the binaries in your router or other embedded system, or the busybox installation you maybe installed in your android phone.
For your server, it's still just a matter of installing the updates from your OS vendor. Updating your phone and your router might be a bit trickier.
I do think it might be useful to have some documentation about the process for updating containers for security updates.
Now that I think about it, I am not really so sure. How do I really know with which glibc various programs were compiled?