Wednesday, January 28, 2015

Ghost Glibc Library Vulerability (CVE-2015-0235)

For more information do take a look at GHOST: glibc vulnerability (CVE-2015-0235)

Background
GHOST is a 'buffer overflow' bug affecting the gethostbyname() and gethostbyname2() function calls in the glibc library. This vulnerability allows a remote attacker that is able to make an application call to either of these functions to execute arbitrary code with the permissions of the user running the application.

Impact
The gethostbyname() function calls are used for DNS resolving, which is a very common event. To exploit this vulnerability, an attacker must trigger a buffer overflow by supplying an invalid hostname argument to an application that performs a DNS resolution.

Resolution:
Update the glibc and ncsd packages on your system

Restart vulnerable services that use glibc (since so many services use glibc, the safest option is to restart the system).

No comments: