<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
... if you have not done so very recently.<br>
<br>
There is an arbitrary code execution vulnerability in glibc, which
is at the core of all systems, which was fixed in late 2013, but not
identified as a vulnerability until recently.<br>
<br>
<a href="https://access.redhat.com/articles/1332213">https://access.redhat.com/articles/1332213</a><br>
<br>
Red Hat and CentOS are patched; but it is notable as noted in the
document link above: <b>All versions of glibc shipped with all
variants of Red Hat Enterprise Linux are affected.<br>
<br>
</b>You can verify your system is patched by running the utility the
source of which appears here:<br>
<br>
<a href="http://www.openwall.com/lists/oss-security/2015/01/27/9">http://www.openwall.com/lists/oss-security/2015/01/27/9</a><br>
<br>
If your system is patched, it will report "not vulnerable":<br>
<br>
[mbt@pbx ~]$ ./ghost<br>
vulnerable<br>
[mbt@pbx ~]$ sudo yum update -y<br>
[... OUTPUT TRIMMED ...]<br>
[mbt@pbx ~]$ ./ghost<br>
not vulnerable<br>
<br>
Don't forget to restart daemon processes so that they get the new C
library, or running processes will continue to be vulnerable after
the update. To reload init, you must reboot the system.<br>
<br>
— Mike<br>
</body>
</html>