A new security vulnerability (CVE-2015-0235) was announced yesterday in GLIBC which allows a remote attacker to execute arbitrary code. The bug is in the GLIBC gethostbyname library calls, so the attacker needs to be able to make your system do certain DNS lookups to exploit the bug.
Any service that uses this library call to do DNS lookups on input that a user provides may be affected. An obvious example would be any system that validates or connects out to user supplied URLs or email addresses but there are so many possibilities that you’re better off updating no matter what.
Updates to GLIBC are now available for most Linux distros so get them upgraded asap. Remember to restart affected services, so they pick up the new version of the library. Some newer distros releases, such as Ubuntu 14.04 (Trusty) aren’t affected and don’t need an update.
We’re currently working on patching our managed customers’ systems and we urge all other customers to apply the available updates as soon as possible.
Whether you’re already a managed customer or not, if you need help upgrading or have any questions do feel free to contact us.
