Linuxのglibcに脆弱性があるとのことで、以下のサイトを参考にバージョンアップしてみました。
- glibc の脆弱性 CVE-2015-0235（通称：GHOST）についてまとめてみた
http://d.hatena.ne.jp/Kango/20150128/1422409960
- glibcのgethostbyname関数に存在するCVE-2015-0235(GHOST)脆弱性について
http://www.walbrix.com/jp/blog/2015-01-ghost.html
まず、私の環境はさくらのVPSでCentOS5を使っています。
# cat /etc/redhat-release
CentOS release 5.10 (Final)
脆弱性の検証ができるとのことでしたので、実施してみました。
# cd /tmp
# curl -sko ghost.c https://raw.githubusercontent.com/mholzinger/CVE-2015-0235_GHOST/master/ghost.c
# gcc ghost.c -o ghost
# ./ghost
vulnerable
vulnerable(脆弱)と表示されました。
glibcをバージョンアップしました。
# yum update glibc
Loaded plugins: fastestmirror
Determining fastest mirrors
* base: ftp.iij.ad.jp
* extras: ftp.iij.ad.jp
* updates: ftp.iij.ad.jp
base | 1.1 kB 00:00
base/primary | 1.3 MB 00:00
base 3667/3667
extras | 2.1 kB 00:00
extras/primary_db | 173 kB 00:00
updates | 1.9 kB 00:00
updates/primary_db | 266 kB 00:00
Setting up Update Process
Resolving Dependencies
--> Running transaction check
--> Processing Dependency: glibc = 2.5-118.el5_10.2 for package: glibc-devel
--> Processing Dependency: glibc = 2.5-118.el5_10.2 for package: nscd
--> Processing Dependency: glibc = 2.5-118.el5_10.2 for package: glibc-headers
---> Package glibc.i686 0:2.5-123.el5_11.1 set to be updated
--> Processing Dependency: glibc-common = 2.5-123.el5_11.1 for package: glibc
---> Package glibc.x86_64 0:2.5-123.el5_11.1 set to be updated
--> Running transaction check
---> Package glibc-common.x86_64 0:2.5-123.el5_11.1 set to be updated
---> Package glibc-devel.x86_64 0:2.5-123.el5_11.1 set to be updated
---> Package glibc-headers.x86_64 0:2.5-123.el5_11.1 set to be updated
---> Package nscd.x86_64 0:2.5-123.el5_11.1 set to be updated
--> Finished Dependency Resolution
Dependencies Resolved
======================================================================================================================================================
Package Arch Version Repository Size
======================================================================================================================================================
Updating:
glibc i686 2.5-123.el5_11.1 updates 5.4 M
glibc x86_64 2.5-123.el5_11.1 updates 4.8 M
Updating for dependencies:
glibc-common x86_64 2.5-123.el5_11.1 updates 16 M
glibc-devel x86_64 2.5-123.el5_11.1 updates 2.4 M
glibc-headers x86_64 2.5-123.el5_11.1 updates 602 k
nscd x86_64 2.5-123.el5_11.1 updates 178 k
Transaction Summary
======================================================================================================================================================
Install 0 Package(s)
Upgrade 6 Package(s)
Total download size: 30 M
Is this ok [y/N]: y
Downloading Packages:
(1/6): nscd-2.5-123.el5_11.1.x86_64.rpm | 178 kB 00:00
(2/6): glibc-headers-2.5-123.el5_11.1.x86_64.rpm | 602 kB 00:00
(3/6): glibc-devel-2.5-123.el5_11.1.x86_64.rpm | 2.4 MB 00:00
(4/6): glibc-2.5-123.el5_11.1.x86_64.rpm | 4.8 MB 00:00
(5/6): glibc-2.5-123.el5_11.1.i686.rpm | 5.4 MB 00:00
(6/6): glibc-common-2.5-123.el5_11.1.x86_64.rpm | 16 MB 00:03
------------------------------------------------------------------------------------------------------------------------------------------------------
Total 4.9 MB/s | 30 MB 00:06
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
Updating : glibc-common 1/12
Updating : glibc 2/12
Updating : nscd 3/12
Updating : glibc-headers 4/12
Updating : glibc 5/12
Updating : glibc-devel 6/12
Cleanup : glibc-headers 7/12
Cleanup : glibc-common 8/12
Cleanup : glibc 9/12
Cleanup : glibc 10/12
Cleanup : nscd 11/12
Cleanup : glibc-devel 12/12
Updated:
glibc.i686 0:2.5-123.el5_11.1 glibc.x86_64 0:2.5-123.el5_11.1
Dependency Updated:
glibc-common.x86_64 0:2.5-123.el5_11.1 glibc-devel.x86_64 0:2.5-123.el5_11.1 glibc-headers.x86_64 0:2.5-123.el5_11.1 nscd.x86_64 0:2.5-123.el5_11.1
Complete!
再起動し、起動後にもう一度確認
# cd /tmp
# ./ghost
not vulnerable
今度は、not vulnerable(脆弱ではない)と表示されました。