The CVE-2015-0235 GHOST Vulnerability

The GHOST vulnerability is a serious weakness in the Linux glibc library. It allows attackers to remotely take complete control of the victim system without having any prior knowledge of system credentials.

Technical jargon:

A heap-based buffer overflow was found in __nss_hostname_digits_dots(), which is used by the gethostbyname() and gethostbyname2() glibc function call. A remote attacker could use this flaw to execute arbitary code with the permissions of the user running the application.

There is a remote code execution risk due to this vulnerability. An attacker who exploits this issue can gain complete control of the compromised system.

At this time only Exim mailserver has been proven to be really vulnerable.

It is called as the GHOST vulnerability as it can be triggered by the GetHOST functions.

• ²⁾Qualys Advisory
• ³⁾RedHat
• ⁴⁾Ubuntu
• ⁵⁾Debian
• ⁶⁾GNU C Library
• ⁷⁾Mitre
• ⁸⁾Discussion about vulnerable services