{"id":318,"date":"2012-09-29T12:39:41","date_gmt":"2012-09-29T16:39:41","guid":{"rendered":"http:\/\/blog.domb.net\/?p=318"},"modified":"2012-09-30T21:30:10","modified_gmt":"2012-10-01T01:30:10","slug":"update-oracle-linux-a-better-alternative-to-centos-really","status":"publish","type":"post","link":"https:\/\/blog.domb.net\/?p=318","title":{"rendered":"Update: Oracle Linux: A better alternative to CentOS \u2026really?"},"content":{"rendered":"

Got a nice hint from Oracle this week that they fixed the lack of having CVE information in their yum repos. As I wrote in a previous blog post, it was disappointing that at the time of releasing OEL for the “masses” they did not have metadata available which put them on par with CentOS. You basically \u00a0needed a spacewalk server to get a brief security, bugfixes or an enhancements overview of installed packages on your system. Having meta data available changes a lot because it makes life for admins easier. Compared to CentOS, which does not provide any<\/strong> meta data information or Redhat where you need to buy<\/strong> a subscription, Oracle now gives you security information for free! And as far as I know they might integrate bugfixes and enhancements too!<\/p>\n

http:\/\/public-yum.oracle.com\/repo\/OracleLinux\/OL6\/3\/base\/x86_64\/repodata\/\"\"<\/p>\n

updateinfo.xml.gz<\/strong><\/em> file is there, which is very nice. Lets do some tests on a freshly installed oel6.3:<\/p>\n

[root@oel6.3 ~]# yum list-security<\/p>\n

CVE-2012-3817 security bind-libs-32:9.8.2-0.10.rc1.el6_3.2.x86_64
\nCVE-2012-4244 security bind-libs-32:9.8.2-0.10.rc1.el6_3.3.x86_64
\nCVE-2012-3817 security bind-utils-32:9.8.2-0.10.rc1.el6_3.2.x86_64
\nCVE-2012-4244 security bind-utils-32:9.8.2-0.10.rc1.el6_3.3.x86_64
\nCVE-2012-3524 security dbus-1:1.2.24-7.0.1.el6_3.x86_64
\nCVE-2012-3524 security dbus-libs-1:1.2.24-7.0.1.el6_3.x86_64
\nCVE-2012-3954 security dhclient-12:4.1.1-31.P1.0.1.el6_3.1.x86_64
\nCVE-2012-3571 security dhclient-12:4.1.1-31.P1.0.1.el6_3.1.x86_64
\nCVE-2012-3571 security dhcp-common-12:4.1.1-31.P1.0.1.el6_3.1.x86_64
\nCVE-2012-3954 security dhcp-common-12:4.1.1-31.P1.0.1.el6_3.1.x86_64
\nCVE-2012-4405 security ghostscript-8.70-14.el6_3.1.x86_64
\nCVE-2012-3405 security glibc-2.12-1.80.el6_3.3.x86_64
\nCVE-2012-3406 security glibc-2.12-1.80.el6_3.3.x86_64<\/p>\n

…<\/p>\n

Nice, having the CVE information is very important. This allows us to see if we have any security related updates. The good thing about having this information is that CVE can be queried and specific security updates can be made.<\/p>\n

Let’s query a CVE information:<\/strong><\/em><\/p>\n

[root@oel63 ~]# yum info-security CVE-2012-2390
\nLoaded plugins: security<\/p>\n

===============================================================================<\/p>\n

===============================================================================
\nUpdate ID : CVE-2012-2390
\nRelease :
\nType : security
\nStatus : final
\nIssued : 2012-05-17
\nCVEs : CVE-2012-2390
\nDescription : Memory leak in mm\/hugetlb.c in the Linux kernel before 3.4.2
\n: allows local users to cause a denial of service
\n: (memory consumption or system crash) via invalid
\n: MAP_HUGETLB mmap operations.
\nupdateinfo info done<\/p>\n

Howto update a specific CVE:<\/strong><\/em><\/p>\n

[root@oel63 ~]# yum update –cve CVE-2012-2337
\nLoaded plugins: security
\nSetting up Update Process
\nResolving Dependencies
\nLimiting packages to security relevant ones
\n1 package(s) needed (+0 related) for security, out of 50 available
\n–> Running transaction check
\n—> Package sudo.x86_64 0:1.7.4p5-11.el6 will be updated
\n—> Package sudo.x86_64 0:1.7.4p5-13.el6_3 will be an update
\n–> Finished Dependency Resolution<\/p>\n

Dependencies Resolved<\/p>\n

To update all security related problems you can execute:<\/strong><\/em><\/p>\n

[root@oel63 ~]# [root@oel63 ~]# yum update –security
\nLoaded plugins: security
\nSetting up Update Process
\nResolving Dependencies
\nLimiting packages to security relevant ones<\/strong>
\n29 package(s)<\/strong> needed (+0 related) for security, out of 50 available
\n–> Running transaction check<\/p>\n

As you can see it would only update the packages which have security related issues.<\/p>\n

Conclusion:<\/p>\n

The fact that Oracle has meta data for their repository and gives it away for free<\/strong> puts them, from a business perspective, clearly ahead of CentOS. It is very important for admins to have the CVE information. Some people will now say, but I can have that too with spacewalk and even get the bugfixes and feature enhancement information. Yes you’re right, but its another component which you’ll have to administrate and maintain. Having the ability to check security updates and maybe in the future bugfixes and enhancements\u00a0 with yum is just so much easier and nicer.\u00a0 So Thanks Oracle for giving us CVE meta data information!<\/p>\n

 <\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Got a nice hint from Oracle this week that they fixed the lack of having CVE information in their yum repos. As I wrote in a previous blog post, it was disappointing that at the time of releasing OEL for the “masses” they did not have metadata available which put them on par with CentOS….<\/p>\n","protected":false},"author":2,"featured_media":287,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"footnotes":""},"categories":[3],"tags":[10,48,9],"class_list":["post-318","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","tag-errata","tag-linux","tag-oel"],"_links":{"self":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=318"}],"version-history":[{"count":43,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/318\/revisions"}],"predecessor-version":[{"id":365,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/318\/revisions\/365"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/media\/287"}],"wp:attachment":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}