Hi,
Is Endian 2.5 / 3.0 version has the GHOST glibc vulnerability? Any patch we can update?
Thanks
Hi,
you can read "https:**access.redhat.com*articles*1332213*" an execute tool (you need a count on red hat)
(replace the * for /)
or maybe
create a sh file
"#!/bin/bash
echo "Installed glibc version(s)"
rv=0
for glibc_nvr in $( rpm -q --qf '%{name}-%{version}-%{release}.%{arch}\n' glibc ); do
glibc_ver=$( echo "$glibc_nvr" | awk -F- '{ print $2 }' )
glibc_maj=$( echo "$glibc_ver" | awk -F. '{ print $1 }')
glibc_min=$( echo "$glibc_ver" | awk -F. '{ print $2 }')
echo -n "- $glibc_nvr: "
if [ "$glibc_maj" -gt 2 -o \
\( "$glibc_maj" -eq 2 -a "$glibc_min" -ge 18 \) ]; then
# fixed upstream version
echo 'not vulnerable'
else
# all RHEL updates include CVE in rpm %changelog
if rpm -q --changelog "$glibc_nvr" | grep -q 'CVE-2015-0235'; then
echo "not vulnerable"
else
echo "vulnerable"
rv=1
fi
fi
done
if [ $rv -ne 0 ]; then
cat <<EOF
This system is vulnerable to CVE-2015-0235.
Please refer to redhat.com/articles/1332213 for remediation steps
EOF
fi
exit $rv"
copy in root
execute
$ chmod +x GHOST-test.sh
$ ./GHOST-test.sh
If the target is vulnerable, you will see output similar to:
This system is vulnerable to CVE-2015-0235
Please refer to 'access.redhat.com/articles/1332213' for more information
If the target is not vulnerable, you will see output similar to:
Not vulnerable.
Author