A vulnerability within the glibc DNS client used by many recent Linux distributions has recently been identified. This vulnerability has the potential to allow malicious access to affected devices and software, allowing a third-party to cause a crash or run malicious code.
A patch to fix the issue has already been released. This patch is documented in more detail here.
If you run an automatic update on your OS, then the patch should have already been downloaded. However you may need to reboot your system in order for it to be applied.
Vulnerable versions of glibc are installed by default on the following operating systems, but also other less popular distributions.
- Legacy customers running RedHat Enterprise 6
- Centos 6
- Centos 7
- Ubuntu 12
- Ubuntu 14
Due to the public nature of the vulnerability, we recommend that you immediately check to ensure that this patch has been installed on your system, and, if necessary, to perform the necessary reboot at your earliest convenience.
Although a reboot will accomplish the desired effect, you may find it tidier to use the ‘checkrestart’ utility (found in the ‘debian goodies’ package, amongst other places – this utility will notify you which running processes are still using old versions of libraries. You can then choose to restart these services individually and manually – this reducing server downtime.
ITSS would like to credit Fasthosts UK for initially being this to our attention.
As a final word, although this is a vulnerability that should be patched quickly – please dont assume that just because this one has made it into the online press – that its the only one to worry about.
All systems should be kept up to date at all times.
If you run an online server, and would like us to monitor it for you and alert you in case of available updates – please use the contact page to get in touch with us. We are also capable of monitoring individual applications, such as wordpress sites – and alerting you when updates are available.
Stay secure! Stay safe!
Regards,
The team at ITSS