CVE-2015-0235 – Ghost Vulnerability

Posted on February 19, 2015. Filed under: Oracle Engineered Systems | Tags: , , |

Post applies to Exadata, Exalogic and Exalytics.

Here is a check script to check if a system is vulnerable to GHOST security vulnerability.

######### testghost.sh #########

/usr/sbin/clockdiff `python -c “print ‘0’ * $((0x10000 – 16 * 1 – 2 * 4 – 1 – 4))” `
echo $?

php -r ‘$e = “0”;for($i = 0; $i < 2500; $i++){ $e = “0$e”; } gethostbyname($e);’
echo $?

###############################

Note: If the first set gives “Segmentation fault” and second returns “139”, then

the vulnerability is present in glibc.

###########################################

[root@server-name ~]# sh testghost.sh
clockdiff: ebs-template: my host not found
1
testghost.sh: line 4: 17976 Segmentation fault      php -r ‘$e = “0”;for($i = 0; $i < 2500; $i++){ $e = “0$e”; } gethostbyname($e);’
139
[root@ebs-template ~]#
###########################################

MOS documents to address the vulnerability

Exalogic :  CVE-2015-0235 – Ghost Vulnerability – Patch Availability for Oracle Exalogic Linux Physical and Virtual Racks (Doc ID 1965975.1)

Exalytics : CVE-2015-0235 AKA “Ghost” vulnerability in glibc – Patch Availability Document for Oracle Exalytics Linux Physical and Virtual systems (Doc ID 1966284.1)

Exadata : glibc vulnerability (CVE-2015-0235) patch availability for Oracle Exadata Database Machine (Doc ID 1965525.1)


Read Full Post | Make a Comment ( None so far )

Recently on OraclePitStop - Lets share some knowledge…

Process exiting status in Oracle Application R12

Posted on May 11, 2009. Filed under: Uncategorized |

Oracle R12 Reports are failing with Rep 3000 error on IBM AIX

Posted on March 24, 2009. Filed under: Uncategorized |

Oracle 11i forms crash in IE

Posted on March 24, 2009. Filed under: Uncategorized |

Is user equivelance really required at the OS level after RAC installation?

Posted on December 18, 2008. Filed under: Database, DBA/Admin Tips, Operating System, RAC, TroubleShooting, Uncategorized | Tags: , , , |

Single Putty Window – Multiple Tabs – for multiple server connections

Posted on December 18, 2008. Filed under: DBA/Admin Tips | Tags: , |

How to migrate PUTTY settings from one windows desktop/laptop to the other?

Posted on December 18, 2008. Filed under: DBA/Admin Tips | Tags: |

Oracle Apps R12 : How to find the list of responsibilities assigned to user(s)

Posted on December 17, 2008. Filed under: DBA/Admin Tips, R12, Scripts | Tags: , , |

dbca – Creating RAC Database using dbca in silent mode

Posted on December 16, 2008. Filed under: Database, DBA/Admin Tips, Linux, RAC, TroubleShooting | Tags: , , |

Interesting enhancements in 12.0.6 – R12.ATG_PF.A.DELTA.6

Posted on December 2, 2008. Filed under: Apps Technology Stack, DBA/Admin Tips, R12, Technology | Tags: , , |

Liked it here?
Why not try sites on the blogroll...

Follow

Get every new post delivered to your Inbox.