How to patch CentOS for the Ghost exploit (or CVE-2015-0235 )
For centos5 and centos6:
execute:
yum clean all && yum update glibc
Then reboot, it should update all linked programs.
The bad thing is that the exploit requires a reboot, this is because running applications still link to the old libraries. You could restart all services linked to glibc manually but you might miss some. The safest way is just to reboot.
The exploit is less extensive than reported in the media, only some running services, like exim, can be exploited to gain privileges and access on a machine. However, it is a mayor security issue and systems have been affected by it since 2000 and not all additional possible exploit vectors are known.
On http://seclists.org/oss-sec/2015/q1/283 most mayor services like the ones below were tested for the vulnerability:
apache, cups, dovecot, gnupg, isc-dhcp, lighttpd, mariadb/mysql, nfs-utils, nginx, nodejs, openldap, openssh, postfix, proftpd, pure-ftpd, rsyslog, samba, sendmail, sysklogd, syslog-ng, tcp_wrappers, vsftpd, xinetd.
These services have been tested and they do not seem exploitable like the publicly released exploit through exim.
There is an easy way to test if you are vulnerable for the exploit:
$ wget https://webshare.uchicago.edu/orgs/ITServices/itsec/Downloads/GHOST.c $ gcc GHOST.c -o GHOST $ ./GHOST
It should return vulnerable or not vulnerable.
Good luck patching your centos linux server for the CVE-2015-0235 exploit!
