Security: Critical security flaw: glibc DNS vulnerability (CVE-2015-7547)
Nick Golovachenko
started a topic
about 8 years ago
A critical security flaw in the "getaddrinfo()" library function in the ubiquitous "glibc" library was publicly disclosed today. An exploit of this flaw would potentially allows an attacker to run code remotely on any vulnerable system by sending it a carefully tailored response to a DNS query. Because of the nature of this vulnerability, it is critical that you apply the security patches as soon as they become available:
Patches are now available now for current releases of Ubuntu, Debian and RedHat Enterprise Linux (RHEL) from the standard channels.
Patches for CentOS, Scientific Linux and Fedora are expected to be available shortly.
If you are running an OS that is no longer getting security patches, you should upgrade as soon as possible. Also check the references below for possible short-term mitigations.
It is advisable to reboot each instance after applying the patches. If that is not possible, then you need to restart all system and application services in the manner appropriate to your system. DNS is used by a large number of services, and they all need to be restarted in order to pick up the patched version of the "getaddrinfo()" library function.
Nick Golovachenko
A critical security flaw in the "getaddrinfo()" library function in the ubiquitous "glibc" library was publicly disclosed today. An exploit of this flaw would potentially allows an attacker to run code remotely on any vulnerable system by sending it a carefully tailored response to a DNS query. Because of the nature of this vulnerability, it is critical that you apply the security patches as soon as they become available:
It is advisable to reboot each instance after applying the patches. If that is not possible, then you need to restart all system and application services in the manner appropriate to your system. DNS is used by a large number of services, and they all need to be restarted in order to pick up the patched version of the "getaddrinfo()" library function.
References: