Oralce uses gethostbyname in "*skgxp*" libraries [CVE-2015-0235]

28.01.2015
by Kamil Stawiarski

Recently there was a new vulnerability introduced in glibc library: http://www.openwall.com/lists/oss-security/2015/01/27/9

Oracle is using the gethostbyname function in "*skgxp*" libraries:

oracle@kokos:~$ find /u01/ -name "*skgxp*" -type f | awk '{system("nm " $0 " | grep gethostbyname &&  echo "$0)}' 2>/dev/null
                 U gethostbyname
/u01/app/oracle/product/12.1.0.1/rdbms/lib/libskgxpr.a
                 U gethostbyname
/u01/app/oracle/product/12.1.0.1/rdbms/lib/libskgxpg.a
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.1/lib/libskgxpg.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.1/lib/libskgxpr.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.1/lib/libskgxp12.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.1/inventory/backup/2014-07-21_08-23-18PM/Scripts/ext/lib/libskgxp12.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.1/inventory/Scripts/ext/lib/libskgxp12.so
                 U gethostbyname
/u01/app/oracle/product/12.1.0.2/rdbms/lib/libskgxpr.a
                 U gethostbyname
/u01/app/oracle/product/12.1.0.2/rdbms/lib/libskgxpg.a
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.2/lib/libskgxpg.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.2/lib/libskgxpr.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.2/lib/libskgxp12.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.2/inventory/backup/2014-07-21_08-40-47PM/Scripts/ext/lib/libskgxp12.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/12.1.0.2/inventory/Scripts/ext/lib/libskgxp12.so
                 U gethostbyname
/u01/app/oracle/product/11.2.0/rdbms/lib/libskgxpr.a
                 U gethostbyname
/u01/app/oracle/product/11.2.0/rdbms/lib/libskgxpg.a
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/11.2.0/lib/libskgxpg.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/11.2.0/lib/libskgxpr.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/11.2.0/lib/libskgxp11.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/11.2.0/inventory/backup/2013-10-14_03-30-09PM/Scripts/ext/lib/libskgxp11.so
                 U gethostbyname@@GLIBC_2.2.5
/u01/app/oracle/product/11.2.0/inventory/Scripts/ext/lib/libskgxp11.so

So this can be an issue – a specially in RAC environments.

RedHat recommends to upgrade the glibc libraries:
https://access.redhat.com/articles/1332213

And I do agree 😉

Search:

Category:
choose
All categories 12c Exadata GO internals konferencje Oracle RAC RMAN RUST security tips&tricks tuning

Popular posts

14.06.2016
ORACLE RAC 12c: restore OCR and VOTEDISK

Let’s fuckup the cluster! Of course after this operation, the final state of the processes can look like this: The cssd service will not be able to start, because there are no voting disks: OK, so let’s try to stop the cluster services: Now we will have to start CRS in exclusive mode and start […]

Read more
10.02.2016
How to list files from directory using external table in 12c

I’ve wrote about privilege escalation with external tables in this post: https://blog.ora-600.pl/2014/12/23/simple-technics-of-privilege-escalation-part2-dbasysdba/ This time we will try to list all files within directory object, to which we have no EXECUTE privs. This is possible due to great new feature of database 12c that allows to use metacharacters to match multiple files in external table. I […]

Read more
03.05.2015
12c: Spatial Vector Acceleration

There is a new feature in Oracle Spatial 12c, called "Spatial Vector Acceleration". According to Oracle: One of the most notable improvements with Oracle Spatial and Graph 12c can be seen in performance increases in vector data operations. Enabling the Spatial Vector Acceleration feature (available with the Spatial option) dramatically improves the performance of commonly […]

Read more
28.05.2017
How to recover a dropped package from archivelogs – based on research for VOODOO engine

Sorry for long time without post, but we are writing with Marcin Rydz a new heterogenous replication product based on archivelogs and it’s consuming a looooooot of our time 🙂 Yes I know it’s nothing new on the market. There are other cool products and I know they’ll be probably be better. But we want […]

Read more
01.02.2017
back to the basics: ALTER TABLE MOVE vs SHRINK

It’s time for the next article with ODBV visualisation 🙂 This time let’s examine the difference between move and shrink – this is very common question on a lot of trainings. You can find a lot of great articles in the Internet regarding this subject but I think that visualisation really helps to understand what […]

Read more
30.12.2016
back to the basics: truncate table reuse storage vs drop storage

From time to time I get questions on my trainings, what is the difference between TRUNCATE TABLE and TRUNCATE TABLE DROP STORAGE… well, there is no difference because DROP STORAGE is default 😉 DROP STORAGE Specify DROP STORAGE to deallocate all space from the deleted rows from the table except the space allocated by the […]

Read more
28.10.2017
Visualize your STATSPACK reports with Python Plotly

If you work as a consultant, getting remote access to your customer is sometimes a nightmare! Even when you’ll get one, there a times when you just want to get your job done and finish this nightmare. For example, there are times when it is easier to dump a statspack repo and do offline analyzes. […]

Read more
08.02.2016
Sparc M7 vs Intel and P8

I had a pleasure to work with my colleagues from Oracle – Radosław Kut and Krzysztof Marciniak – at comparing the performance of In-Memory queries between Sparc M7, Intel® Xeon® X5670 and Intel® Xeon® E5-2699. You can find results of our findings in this presentation: https://www.oracle.com/webfolder/s/delivery_production/docs/FY16h1/doc17/DB12c-on-SPARC-M7.pdf Following their methodology I’d like to present appropriate results […]

Read more
29.10.2015
Oracle 12c: PRAGMA UDF – the truth

Let’s check, why PRAGMA UDF makes execution faster, then regular function. C function responsible for calling a PL/SQL code from SQL is called "plsql_run": Now let’s try to create a new HR session and create a simple function which will multiple values by 2: From other terminal I will connect to the HR session with […]

Read more
12.03.2017
ODBV improvements

Thanks to suggestions made by Frits Hoogland, I made some improvements to the ODBV. The new version can be found here: http://ora-600.pl/oinstall/odbv.x86_64 The changes are: Recognition of first, second and third level bitmap block Recognition of pagetable segment header Block number ranges on the left side The blocks will be coloured properly to belonging segment. […]

Read more
03.11.2016
Oracle Database Block Visualizer

Recently I wanted to demonstrate to some people on my training, how Oracle database maintains blocks in a datafile – what happens after truncate, truncate with drop storage clause, delete, regular insert, direct path insert and so on… I didn’t find any tool for that so I’ve written my own. It’s core code is based […]

Read more
27.01.2015
Slow TRUNCATE TABLE due to operations on MON_MODS$

One of my customers had a problem with a very slow TRUNCATE TABLE operation on a partitioned table having 22 000 partitions. The problem has raised after a test migration to database 12c. I’ve prepared a little demo to address this issue and show the walkaround for it. Oracle Database 12c (12.1.0.2): Oracle Database 11g […]

Read more

Contact us

Database Whisperers sp. z o. o. sp. k.
al. Jerozolimskie 200, 3rd floor, room 342
02-486 Warszawa
NIP: 5272744987
REGON:362524978
+48 508 943 051
+48 661 966 009
info@ora-600.pl

Newsletter Sign up to be updated