Many Millions of Linux are affected by this security hole #2

[gcmartin]

Reported yesterday.

[slavvo67]

Do we have a puppy patch?

[6502coder]

DEBs for Precise, Tahr, and Wily can be found here:

http://www.ubuntu.com/usn/usn-2900-1/

Click the link corresponding to your flavor of Ubuntu (Precise, Tahr, or Wily)
On the resulting web page, look over on the right-hand side where it says "Builds".

Click the link corresponding to your hardware (e.g. i386) to get to the list of DEBs.
You will want two DEBs, the libc6 and libc-bin.
For example for Precise you want

libc6_2.15-0ubuntu10.13_i386.deb
libc-bin_2.15-0ubuntu10.13_i386.deb

Download the DEBs and left click each to install.

[greengeek]

Any tips on how to identify which version of glibc a puppy has? cheers

EDIT : See this post
Enter the following in a terminal:
/lib/libc.so.6

or:
Enter the following in a terminal:
ldd --version

[Moat]

DEBs for Precise, Tahr, and Wily can be found here:

Thanks @ 6502coder!

Bob

[anikin]

Debian users see here:
https://www.debian.org/security/2016/dsa-3481
and for more details here:
https://security-tracker.debian.org/tra ... -2015-7547

@ greengeek

Code: Select all

root@debian:~# ldd --version
ldd (Debian GLIBC 2.21-8) 2.21
Copyright (C) 2015 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
root@debian:~#

[rufwoof]

Debian users see here:
https://www.debian.org/security/2016/dsa-3481
and for more details here:
https://security-tracker.debian.org/tra ... -2015-7547

@ greengeek

Code: Select all

root@debian:~# ldd --version
ldd (Debian GLIBC 2.21-8) 2.21
Copyright (C) 2015 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
root@debian:~#

I run DD Jessie openbox with Optional Persistence (frugal boot and only preserve changes if I opt to save) and I hit a problem with applying the Debian update as per here (which also outlines how to work around that). Only applies if you use the changes=EXIT:/live/ boot parameter choice (i.e. Optional Persistence).

[gcmartin]

@JamesBond announces a fix to FD702, today.

[rufwoof]

Not sure, but I did see additional suggestions that it might not be just glibc that needs fixing/patching, but also other things such as python.

Debian have released updates for Libre and Python today (after releasing a glibc update) http://murga-linux.com/puppy/viewtopic. ... 032#890032

[slavvo67]

Any way to determine that the patch worked? For example, recall the heartbleed sight that tested.

[anikin]

“A big deal

[Burn_IT]

I other words there is nothing you can do to prevent it without going right back to the source of all Linux.

[Flash]

What is the practical danger, that you could go to a URL without realizing it?

[Dingo]

I remember I read that only GNU C Libraries since 2.9 are affected

so, puppy 3.01 with its

GNU C Library stable release version 2.5

is secure?

[8Geee]

I think so Flash, that does appear to be near the bottom line. Browser-Tools like Redirect Cleaner should help. But when one is running a server with a high amount of automation/networking, the browser isn't the only entrance. And further, human eyes are not involved.

If I may, my purposes and wants/needs really don't rely upon shares or servers. I toss them out of my personal-use puppy. I do leave the config files intact. If it ain't there it can't be exploited. So things like transmission, sylpheed, samba, etc are not there and don't need updates. YRMV

[greengeek]

What is the practical danger, that you could go to a URL without realizing it?

The article that anikin linked above says:

Researchers have discovered a potentially catastrophic flaw in one of the Internet's core building blocks that leaves hundreds or thousands of apps and hardware devices vulnerable to attacks that can take complete control over them.

which makes it sound more serious than just a misplaced redirect.

Interesting that the RedHat fellas knew about it and didn't pass the info on to other Linux devs.

[greengeek]

..so, puppy 3.01 with its GNU C Library stable release version 2.5 is secure?

Do you have a 3.01 puppy iso that you could recommend?

[rufwoof]

I remember I read that only GNU C Libraries since 2.9 are affected

so, puppy 3.01 with its

GNU C Library stable release version 2.5

is secure?

Anything compiled with pre 2.9 GNU C libs would not have the flaw - but being relatively old could contain other flaws! Also, even though you might be running a pup compiled with pre 2.9 libs, other programs might have been compiled using 2.9 or later. Bitcoin, Teamviewer (not saying they have, just using them as possible examples).

[6502coder]

Just guessing, but the claim that gazillions of programs are affected is probably counting programs that use the libc shared libraries. In that case, fixing the shared libs should generally "fix" the program. Programs that were statically compiled of course are SOL and would have to be recompiled.

[jss83]

What deb files for tahrpup? I can't find them.