Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] We have a vulnerable glibc (2.13) in stable

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Vlad Glagolev <stealth AT tiberian.ru>
  • To: sm-discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] We have a vulnerable glibc (2.13) in stable
  • Date: Thu, 29 Jan 2015 10:33:28 +0300

I hope we'll roll out 0.61-21 stable, once our infrastructure is
recovered.

But for now you can get an updated glibc spell which will go into
stable from my personal grimoire. It can be accessed via rsync:

scribe add prototype from rsync://rsync.stealth.zone::codex/prototype/

you only need glibc spell from there, but besides it the grimoire
contains several spells from test.

glibc spell has a rearranged official patch for 2.13 and 2.3.6 versions
of glibc we have in current stable (0.61-20). I've tested it on 3 boxes
-- no problems so far, and will continue upgrading on others (around 85
machines) today. I'll report back if I find any issues related to the
security upgrade process.

On Wed, 28 Jan 2015 09:08:38 -0600
David Kowis <dkowis AT shlrm.org> wrote:

> As of 28 Jan 2015:
> http://dbg.download.sourcemage.org/grimoire/codex/stable/libs/glibc/DETAILS
>
>
> https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability
>
> If I'm parsing that DETAILS file correctly (which by the way, it's super
> nasty), it's possible to get a glibc version of 2.13, which is super
> vulnerable to all sorts of things.
>
> My upgrade history with glibc has not been very good, as in when I
> update glibc, somehow I manage to hork the entire system and have to
> reinstall, so I'd appreciate it if someone else worked on it, heh.
>
> Also, it should be known that you can get a vulnerable glibc in stable
> sourcemage. So this is making it known
>


--
Vlad Glagolev <stealth AT tiberian.ru>

Attachment: pgpwsWXMCIVBC.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page