Linux "GHOST" Vulnerability Hits Glibc Systems

[rohcQaH]

This just in: bug in ancient glibc version found. Due to misinformation, much panic ensues, but in the end nobody cares.

I moved to no-emul one one machine a few weeks ago. One problem worth mentioning is qt-sql. Going no-emul had a side-effect of requiring >=virtual-mysql-5.6, which ended up requiring mariadb-10.0, which I presume was going to hit a bunch of other packages. I ended up unmasking emul-linux-x86-qttlibs-20140508-r1 and have that one piece of emul left.

qt-sql wants to link to the mysql client libraries. Unless you can set USE="-mysql" on qt-sql, install mysql (or maybe mariadb) with USE="minimal". That'll only install the client libs and headers, not the actual server.

I found that some stuff wouldn't build/upgrade until I got to gcc-4.8.

IIRC 4.8 is the first version with usable C++11 support. If you have packages that use the new c++ features, gcc-4.7 won't do.

[brosis]

Gentoo is fantastic. I use it almost exclusively for my personal OS. But for the network I maintain I have been using Redhat. Specifically for situations just like this. It's nice to have that commercial support. I got the server images updated today, but I still have to deploy them. The thin clients and workstations I'm not too concerned about. I'm already working on a new image for the thin clients anyway, so I'll throw this fix in that image.

Used both, then Calculate. I would say, if your system is decent CPU-wise, go Gentoo or Calculate all the way. Otherwise, go Debian. Arch has an issue, that it does not utilize its own lddd, or even better - fixbrokenpackages, which often results in AUR package breakages after any update. As its not advertised wide, most of the Arch systems are affected. Additionally, I found out that migration from older systems to newer ones with Debian was a lot smarter and more automated, which cooped with absent partial-upgrades (contrary to Debian or even Gentoo) makes Arch the most fragile system among the three. Not mentioning RH, since I am not using it.

[duby229]

Used both, then Calculate. I would say, if your system is decent CPU-wise, go Gentoo or Calculate all the way. Otherwise, go Debian. Arch has an issue, that it does not utilize its own lddd, or even better - fixbrokenpackages, which often results in AUR package breakages after any update. As its not advertised wide, most of the Arch systems are affected. Additionally, I found out that migration from older systems to newer ones with Debian was a lot smarter and more automated, which cooped with absent partial-upgrades (contrary to Debian or even Gentoo) makes Arch the most fragile system among the three. Not mentioning RH, since I am not using it.

I will say that updating gentoo is still a pain in the ass. If you let it go too long it becomes nearly impossible. The more often you do it, the easier it is.

[toyotabedzrock]

This is what pisses me off about linux, the devs act like their world will cave in if they regularly update the libraries they use for building the kernel of anything really.

[zxy_thf]

This just in: bug in ancient glibc version found. Due to misinformation, much panic ensues, but in the end nobody cares.

It's not ancient since all RHEL (including CentOS and Scientific Linux certainly), Ubuntu 12.04 LTS and Debian LTS are affected.
They are the majority of Linux users.

However people living on the cutting edge are not affected (I'm one of them )

[stqn]

It's not ancient since all RHEL (including CentOS and Scientific Linux certainly), Ubuntu 12.04 LTS and Debian LTS are affected.
They are the majority of Linux users.

Source? I?m not aware that we suddenly have statistics about which distros Linux users use?

Apart from the Steam survey which lists the following distros as the most used:
Ubuntu 14.04.1 LTS 64 bit
Ubuntu 14.10 64 bit
Linux 3.10 64 bit
Linux Mint 17 Qiana 64 bit
Ubuntu 14.04.1 LTS
Linux Mint 17.1 Rebecca 64 bit
(source: http://store.steampowered.com/hwsurvey)

I?m not seeing any of the distros you listed. "Linux 3.10 64 bit" might contain some of them but it?s only 0.09% out of the 1.10% of Linux users on Steam, far from the majority.

[duby229]

Source? I?m not aware that we suddenly have statistics about which distros Linux users use?

Apart from the Steam survey which lists the following distros as the most used:
Ubuntu 14.04.1 LTS 64 bit
Ubuntu 14.10 64 bit
Linux 3.10 64 bit
Linux Mint 17 Qiana 64 bit
Ubuntu 14.04.1 LTS
Linux Mint 17.1 Rebecca 64 bit
(source: http://store.steampowered.com/hwsurvey)

I?m not seeing any of the distros you listed. "Linux 3.10 64 bit" might contain some of them but it?s only 0.09% out of the 1.10% of Linux users on Steam, far from the majority.

I seriously doubt anybody has steam installed on their servers. And let's face it, there are a lot more linux servers than there are linux desktops.

[duby229]

EDIT: The other problem with Steam's survey is that it doesn't poll everyone everytime. There is no chance that it's accurate. I use Linux Steam quite a bit nowadays, because a few games I purchased have become available, and I've never gotten the survey.

[antus]

The long term support (LTS) and distros based on RHEL (centos, scientific, etc) arnt really used for gaming because because they are too old. They were not patched because the GHOST vulnerability was not deemed a security issue when it was first discovered so those distros decided the patch was not needed and opted out for system stability at the time.

In addition steam's steam OS is based on ubuntu, so while the steam app has been repackaged for other distros it makes sense most would be on an ubuntu distro base.

GHOST isnt really as bad as its made out to be because you only get a couple of bytes of code to run, so you need to know the relative offset to a buffer you can fill with shell code or the like so you can use those bytes to execute a single jump command to the pre-loaded payload in some other buffer. With address randomisation and because this is very app / system specific the barrier to abusing it is reasonly high. Im sure it has and will happened, but its not like some script kiddy can get 'the' explot and suddenly exploid any and all apps using the affected gethostbyname() functions. Also, probably selinux would save you on systems where its not disabled (granted thats probably a lot unfortunately).

See here for a longer description: http://blog.trendmicro.com/trendlabs...vulnerability/

[Luke_Wolf]

The long term support (LTS) and distros based on RHEL (centos, scientific, etc) arnt really used for gaming because because they are too old. They were not patched because the GHOST vulnerability was not deemed a security issue when it was first discovered so those distros decided the patch was not needed and opted out for system stability at the time.

In addition steam's steam OS is based on ubuntu, so while the steam app has been repackaged for other distros it makes sense most would be on an ubuntu distro base.

GHOST isnt really as bad as its made out to be because you only get a couple of bytes of code to run, so you need to know the relative offset to a buffer you can fill with shell code or the like so you can use those bytes to execute a single jump command to the pre-loaded payload in some other buffer. With address randomisation and because this is very app / system specific the barrier to abusing it is reasonly high. Im sure it has and will happened, but its not like some script kiddy can get 'the' explot and suddenly exploid any and all apps using the affected gethostbyname() functions. Also, probably selinux would save you on systems where its not disabled (granted thats probably a lot unfortunately).

See here for a longer description: http://blog.trendmicro.com/trendlabs...vulnerability/

SteamOS is based on Debian proper not Ubuntu, Valve just pimped out Ubuntu and Linux mint when it first announced the port