CVE-2015-0235

glibc vulnerability (CVE-2015-0235) patch availability for Oracle Exadata Database Machine (文档 ID 1965525.1)

转到底部

Oracle Exadata Storage Server Software - Version 11.2.1.2.0 to 12.1.2.1.0 [Release 11.2 to 12.1]
Information in this document applies to any platform.

The glibc vulnerability covered by CVE-2015-0235 affects multiple components in the Oracle Exadata Database Machine. This note provides information on the updates available and how to obtain and install them.  

For additional information about other commonly identified security vulnerabilities on Oracle Exadata Database Machine, see Note 1405320.1.

For additional information on the vulnerability, see CVE report, ELSA-2015-0090, ELSA-2015-0092 and OVMSA-2015-0024.

4       Download and stage the files needed

For Exadata image versions 12.1.1.1.1 or earlier, obtain updated packages using the following package versions, or later package versions, if available:

glibc-2.5-123.0.1.el5_11.1.i686.rpm
glibc-2.5-123.0.1.el5_11.1.x86_64.rpm
glibc-common-2.5-123.0.1.el5_11.1.x86_64.rpm
glibc-devel-2.5-123.0.1.el5_11.1.i386.rpm
glibc-devel-2.5-123.0.1.el5_11.1.x86_64.rpm
glibc-headers-2.5-123.0.1.el5_11.1.x86_64.rpm
glibc-utils-2.5-123.0.1.el5_11.1.x86_64.rpm
nscd-2.5-123.0.1.el5_11.1.x86_64.rpm

These packages may be obtained from http://public-yum.oracle.com/repo/OracleLinux/OL5/latest/x86_64/.

5       Oracle Exadata Database Servers physical installs running Linux and domU on virtual installs

These steps may be followed to update Oracle Exadata Database Servers running physical installs (all installs before Exadata version 12.1.2.1.0 are physical installs) and also for updating the domU virtual machines on Oracle Exadata Database Server virtual installations (see next section below for dom0 update). For instructions to update the Oracle Exadata Database Server dom0 on virtual installations, see the next section.  

To install these packages on database servers, follow the steps below (applicable to all Exadata image versions). These may be done in parallel on all database servers or in a rolling manner. It is intended that the package installation is followed by a system reboot in a relatively short time (i.e. minutes, not days). Since the system will be rebooted, you may choose to stop the database and cluster processes on the node being updated in advance or allow the reboot process to stop them for you. 

1. Capture the currently installed rpm versions (including package architectures) using the following command and save the output in a file in case a rollback is needed later.
   1. rpm -qa --queryformat="%{name}-%{version}-%{release}.%{arch}\n" | egrep 'glibc|nscd'
2. Stage the files on each database server in /tmp/glibc-update as root
   1. mkdir /tmp/glibc-update
   2. Place all the rpms listed above (for your appropriate release) in the directory /tmp/glibc-update
3. If running Exadata phyiscal (non-OVM) installations, follow these steps:
   1. If using Exadata Database Server image version 11.2.3.3.0 or later on Sun/Oracle hardware (V2 through X4), run this command
      1. rpm -e exadata-sun-computenode-exact
      2. Note that removing this package will not affect future upgrades. If the package is not installed, this step can be skipped.
   2. If using Exadata Database Server image version 11.2.3.3.0 or later on HP V1 hardware, run this command
      1. rpm -e exadata-hp-computenode-exact
      2. Note that removing this package will not affect future upgrades. If the package is not installed, this step can be skipped.
4. If running Exadata 12.1.2.1.0 in an virtual installation, follow this step on domUs (see next section below for dom0 update):
   1. rpm -e exadata-sun-vm-computenode-exact
   2. Note that removing this package will not affect future upgrades. If the package is not installed, this step can be skipped.
5. For all releases: install the updated rpms using this command
   1. rpm -Fvh /tmp/glibc-update/*rpm
6. If the installation is successful (no errors), reboot the system using
   1. shutdown -r -y now
7. After the reboot, ensure the system is up and running and the cluster processes have restarted. Remove the staged files, if desired
   1. rm -rf /tmp/glibc-update

If a rollback is required, it should be done with Oracle Support guidance via an SR. The information gathered in step 1 above should be provided to the SR. 

Note that it is not necessary to relink any binaries after this update. 

6       Oracle Exadata Database Servers virtual installs dom0

These steps may be followed to update dom0 on Oracle Exadata Database Servers running virtual installs.  

To install these packages on dom0, follow the steps below. These may be done in parallel on all database servers or in a rolling manner. It is intended that the package installation is followed by a dom0 reboot in a relatively short time (i.e. minutes, not days). Rebooting dom0 will also cause all the domUs to reboot. Since the system will be rebooted, you may choose to stop the database and cluster processes on the node being updated in advance or allow the reboot process to stop them for you. 

1. Capture the currently installed rpm versions (including package architectures) using the following command and save the output in a file in case a rollback is needed later.
   1. rpm -qa --queryformat="%{name}-%{version}-%{release}.%{arch}\n" | egrep 'glibc|nscd'
2. Stage the files on each database server in /tmp/glibc-update as root
   1. mkdir /tmp/glibc-update
   2. Place all the rpms listed above (for your appropriate release) in the directory /tmp/glibc-update
3. If using Exadata Database Server virtual install dom0 on Sun/Oracle hardware (X2 through X4), run this command
   1. rpm -e exadata-sun-ovs-computenode-exact
   2. Note that removing this package will not affect future upgrades. If the package is not installed, this step can be skipped.
4. For all releases: install the updated rpms using this command
   1. rpm -Fvh /tmp/glibc-update/*rpm
5. If the installation is successful (no errors), reboot the system using
   1. shutdown -r -y now
   2. This will reboot dom0 which will first stop all the domUs on the system, reboot dom0, then start the domUs set to auto start.
6. After the reboot, ensure the system is up and running and the cluster processes have restarted. Remove the staged files, if desired
   1. rm -rf /tmp/glibc-update

If a rollback is required, it should be done with Oracle Support guidance via an SR. The information gathered in step 1 above should be provided to the SR. 

7       Oracle Exadata Database Servers running Solaris

Solaris systems do not include glibc.

8       Oracle Exadata Storage Cells