ORA-600 — Database WhisperersFIELD NOTESTHE ORA-600 BLOGSearch /
← All field notes
security1 min read

Oralce uses gethostbyname in "*skgxp*" libraries [CVE-2015-0235]

Kamil Stawiarski / ORA-600

Recently there was a new vulnerability introduced in glibc library: http://www.openwall.com/lists/oss-security/2015/01/27/9

Oracle is using the gethostbyname function in "*skgxp*" libraries:

ora600@lab ~ / text#01
oracle@kokos:~$ find /u01/ -name "*skgxp*" -type f | awk '{system("nm " $0 " | grep gethostbyname &&  echo "$0)}' 2>/dev/null
                 U gethostbyname
/u01/app/oracle/product/12.1.0.1/rdbms/lib/libskgxpr.a
                 U gethostbyname
/u01/app/oracle/product/12.1.0.1/rdbms/lib/libskgxpg.a
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.1/lib/libskgxpg.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.1/lib/libskgxpr.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.1/lib/libskgxp12.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.1/inventory/backup/2014-07-21_08-23-18PM/Scripts/ext/lib/libskgxp12.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.1/inventory/Scripts/ext/lib/libskgxp12.so
                 U gethostbyname
/u01/app/oracle/product/12.1.0.2/rdbms/lib/libskgxpr.a
                 U gethostbyname
/u01/app/oracle/product/12.1.0.2/rdbms/lib/libskgxpg.a
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.2/lib/libskgxpg.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.2/lib/libskgxpr.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.2/lib/libskgxp12.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.2/inventory/backup/2014-07-21_08-40-47PM/Scripts/ext/lib/libskgxp12.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.2/inventory/Scripts/ext/lib/libskgxp12.so
                 U gethostbyname
/u01/app/oracle/product/11.2.0/rdbms/lib/libskgxpr.a
                 U gethostbyname
/u01/app/oracle/product/11.2.0/rdbms/lib/libskgxpg.a
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/11.2.0/lib/libskgxpg.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/11.2.0/lib/libskgxpr.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/11.2.0/lib/libskgxp11.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/11.2.0/inventory/backup/2013-10-14_03-30-09PM/Scripts/ext/lib/libskgxp11.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/11.2.0/inventory/Scripts/ext/lib/libskgxp11.so
44 LINESTEXT / UTF-8

So this can be an issue – a specially in RAC environments.

RedHat recommends to upgrade the glibc libraries:
https://access.redhat.com/articles/1332213

And I do agree 😉

Code listings

#01 text 44 lines
END OF FIELD NOTE / 2015-01-28

Keep asking why. Keep looking deeper.

← Back to the blog

CONTINUE READING