Glibc 2.14 upgrade for using yara-python

[digitalfate]

Hi all,

I am just preparing my Kali system for some malware analysis and I can't fix the following problem.

Python 2.7.3 (default, Jan  2 2013, 13:56:14)
[GCC 4.7.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import yara
Failed to import '/usr/lib/libyara.so'
PATH = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin;/usr/lib
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python2.7/dist-packages/yara-1.7.5-py2.7.egg/yara/__init__.py", line 7, in <module>
    from yara.rules import compile
  File "/usr/local/lib/python2.7/dist-packages/yara-1.7.5-py2.7.egg/yara/rules.py", line 17, in <module>
    from yara.libyara_wrapper import *
  File "/usr/local/lib/python2.7/dist-packages/yara-1.7.5-py2.7.egg/yara/libyara_wrapper.py", line 315, in <module>
    libyaradll = cdll.LoadLibrary(library)
  File "/usr/lib/python2.7/ctypes/__init__.py", line 443, in LoadLibrary
    return self._dlltype(name)
  File "/usr/lib/python2.7/ctypes/__init__.py", line 365, in __init__
    self._handle = _dlopen(self._name, mode)
OSError: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.14' not found (required by /usr/lib/libyara.so)

My current version of libc6: 2.13-38
My current Kernel: Linux cert-kali 3.7-trunk-amd64 #1 SMP Debian 3.7.2-0+kali8 x86_64 GNU/Linux

Apt-get update / upgrade does not provide any newer packages with the default sources from Kali.
I tried to download & compile the newest version of glibc (2.18) but the sanity checks strictly recommend me to not update 'cause it would make the system unusable.

Does anyone have a solution for that or could point me into the right direction?

Thanks and best regards,
Digitalfate

[0E 800]

I was able to install libc6 2.17

IMPORTANT*
You need to exit out of your display manager by pressing CTRL-ALT-F1.
Enter root credentials.
Then you can stop x with /etc/init.d/slim stop

(replace slim with mdm or lightdm or gdm3 or whatever your current display manager is)

Add the following line to the file /etc/apt/sources.list: (nano /etc/apt/sources.list)

deb http://ftp.debian.org/debian sid main

Update your package database:
apt-get update

Install the eglibc package:

apt-get -t sid install libc6-amd64 libc6-dev

IMPORTANT
After done updating libc6, restart computer, and you should comment out or remove the sid source you just added (deb http://ftp.debian.org/debian sid main), or else you risk upgrading your whole distro to sid and will most likely corrupt your distro.

Hope this helps. It took me a while to figure out.

Regard,

0E 800

[digitalfate]

Hi 0E 800,

thanks for your reply (and your email)! I have to confess that I already gave up and installed the 32bit Version ;-). But I will keep your hint in mind if I am about to upgrade / re-install at a later time.

Best regards,
Stefan

[reiser]

I was able to install libc6 2.17

IMPORTANT*
You need to exit out of your display manager by pressing CTRL-ALT-F1.
Enter root credentials.
Then you can stop x with /etc/init.d/slim stop

(replace slim with mdm or lightdm or gdm3 or whatever your current display manager is)

Add the following line to the file /etc/apt/sources.list: (nano /etc/apt/sources.list)

deb http://ftp.debian.org/debian sid main

Update your package database:
apt-get update

Install the eglibc package:

apt-get -t sid install libc6-amd64 libc6-dev

IMPORTANT
After done updating libc6, restart computer, and you should comment out or remove the sid source you just added (deb http://ftp.debian.org/debian sid main), or else you risk upgrading your whole distro to sid and will most likely corrupt your distro.

Hope this helps. It took me a while to figure out.

Regard,

0E 800

Thanks, this worked for me. My problem was related to 3.11.0-031100rc4-generic headers and virtualbox.