GHOST (CVE-2015-0235)

Because glibc is a foundational Linux component, GHOST required broad package review even where applications did not directly expose the affected functions. The case illustrates the operational reach of flaws in shared system libraries.

GHOST is the name given to CVE-2015-0235, a heap-based buffer overflow in the GNU C Library. NVD describes the flaw in the internal __nss_hostname_digits_dots function used in connection with gethostbyname and gethostbyname2.

Scope

The vulnerability affected glibc 2.2 and other 2.x releases before 2.18. Whether it was exploitable in a particular service depended on how that service used the library hostname-resolution functions.

Qualys disclosed the issue in January 2015 and published technical analysis. Linux distributors issued package advisories and updates for affected releases.

Remediation

The principal response was to update glibc packages supplied by the relevant operating-system vendor. The incident highlighted why inventory and patching processes must include transitive shared-library dependencies.

Timeline

2015-01-27GHOST is publicly disclosed as CVE-2015-0235.
2015-01Linux distributors publish updates and advisories for affected glibc packages.

Sources

GHOST (CVE-2015-0235)

Type: Vulnerability / Discovery
Era: 2015
Key date: 2015-01-27
Tags: ghost, glibc, cve-2015-0235, linux, buffer-overflow, dns

Created by Joas A Santos · Something wrong or want it removed? Open an issue.