CVE-2015-0235

Home/CVE/Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,

CVE

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST.".

HIGH · CVSS 10 EPSS 0.8487

Act now

EPSS ≥ 0.50 - high probability of exploitation in the next 30 days
EPSS percentile: top 1% of all CVEs by exploitation likelihood
Public exploit or PoC is available
CVSS base score ≥ 7.0

Sigma rules9 YARA rules0

⬡

Weakness Classification

CWE-787Out-of-bounds Write

▤

Affected Products & Versions

gnu glibc>= 2.0 and < 2.18
oracle communications application session controller< 3.7.1
oracle communications eagle application processorall versions
oracle communications eagle lnp application processorall versions
oracle communications lsmsall versions
oracle communications policy managementall versions
oracle communications session border controller< 7.2.0
oracle communications session border controllerall versions
Show all 21 affected productsoracle communications user data repository>= 10.0.0 and <= 10.0.1
oracle communications webrtc session controllerall versions
oracle exalogic infrastructureall versions
oracle vm virtualbox< 5.1.24
oracle linuxall versions
debian linuxall versions
redhat virtualizationall versions
apple mac os x< 10.11.1
ibm pureapplication systemall versions
ibm security access manager for enterprise single sign-onall versions
php>= 5.4.0 and < 5.4.38
php>= 5.5.0 and < 5.5.22
php>= 5.6.0 and < 5.6.6

⚠

Public Exploits & PoCs

remoteExim - 'GHOST' glibc gethostbyname Buffer Overflow (Metasploit)verified
dosExim ESMTP 4.80 - glibc gethostbyname Denial of Service2015-01-29
pocpacketstormsecurity.com · Exim-ESMTP-GHOST-Denial-Of-Service.htmlpacketstormsecurity.com
pocpacketstormsecurity.com · EMC-Secure-Remote-Services-GHOST-SQL-Injection-Command-In...packetstormsecurity.com
pocpacketstormsecurity.com · Exim-GHOST-glibc-gethostbyname-Buffer-Overflow.htmlpacketstormsecurity.com
pocpacketstormsecurity.com · WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-...packetstormsecurity.com
pocpacketstormsecurity.com · Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-So...packetstormsecurity.com
pocpacketstormsecurity.com · Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Back...packetstormsecurity.com
pocwww.securityfocus.com · threadedwww.securityfocus.com

◈

Sigma Hunt Rules

Exact rules name this CVE ID. Product rules name an affected product in their title. Related rules cover techniques used by actors who exploited this CVE. Showing the most relevant matches; the complete related set is on the full drill-down.

productmediumPowershell Detect Virtualization Environment

productcriticalLinux Reverse Shell Indicator

producthighCommunication To LocaltoNet Tunneling Service Initiated - Linux

producthighPotentially Suspicious Malware Callback Communication - Linux

producthighLinux Crypto Mining Pool Connections

producthighCommunication To Ngrok Tunneling Service - Linux

Show all 9 top matches

producthighLinux Crypto Mining Indicators

producthighShell Execution GCC - Linux

producthighShell Execution via Rsync - Linux

▣

Scoring & Timeline

HIGH · CVSS v2 (legacy) · secalert@redhat.com

View on NVD

This CVE predates CVSS v3; the legacy v2 score is shown so triage still has a severity to work with.

v2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Published to NVD28 Jan 2015 · 07:59 PM

⚑

Vendor Advisories

suse-csafopenSUSE-SU-2024:10290-1
suse-csafopenSUSE-SU-2024:10344-1
suse-csafopenSUSE-SU-2024:11169-1
usnUSN-2485-1
rhsaRHSA-2015:0092Critical
Show all 15 vendor advisoriesrhsaRHSA-2015:0090Critical
rhsaRHSA-2015:0126Critical
rhsaRHSA-2015:0101Critical
rhsaRHSA-2015:0099Critical
suse-csafsuse-ru-2015_0794-1
suse-csafSUSE-SU-2015:0253-1
suse-csafSUSE-SU-2015:0439-1
suse-csafSUSE-SU-2015:0551-1
cisa-csafcisa-csaf-csaf_files-OT-white-2015-icsa-15-064-01
cisa-csafcisa-csaf-csaf_files-OT-white-2015-icsa-15-064-01a

🔗

References & Sources

Source URLs (vendor pages, mailing lists, write-ups). Exploit/PoC links are in their own section above to avoid duplication.

http://blogs.sophos.com/2015/01/29/sophos-products-and-the-ghost-vulnerability-affecting-linux/Third Party Advisory

http://linux.oracle.com/errata/ELSA-2015-0090.htmlThird Party Advisory

http://linux.oracle.com/errata/ELSA-2015-0092.htmlThird Party Advisory

http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.htmlMailing ListThird Party Advisory

http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.htmlMailing ListThird Party Advisory

http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.htmlMailing ListThird Party Advisory

Show all 73 references

http://marc.info/?l=bugtraq&m=142296726407499&w=2Issue TrackingMailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=142721102728110&w=2Issue TrackingMailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=142722450701342&w=2Issue TrackingMailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=142781412222323&w=2Issue TrackingMailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=143145428124857&w=2Issue TrackingMailing ListThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-0126.htmlThird Party Advisory

http://seclists.org/fulldisclosure/2015/Jan/111Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2019/Jun/18ExploitMailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2021/Sep/0ExploitMailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2022/Jun/36ExploitMailing ListThird Party Advisory

http://seclists.org/oss-sec/2015/q1/269Mailing ListThird Party Advisory

http://seclists.org/oss-sec/2015/q1/274ExploitMailing ListThird Party Advisory

http://secunia.com/advisories/62517Not Applicable

http://secunia.com/advisories/62640Not Applicable

http://secunia.com/advisories/62667Not Applicable

http://secunia.com/advisories/62680Not Applicable

http://secunia.com/advisories/62681Not Applicable

http://secunia.com/advisories/62688Not Applicable

http://secunia.com/advisories/62690Not Applicable

http://secunia.com/advisories/62691Not Applicable

http://secunia.com/advisories/62692Not Applicable

http://secunia.com/advisories/62698Not Applicable

http://secunia.com/advisories/62715Not Applicable

http://secunia.com/advisories/62758Not Applicable

http://secunia.com/advisories/62812Not Applicable

http://secunia.com/advisories/62813Not Applicable

http://secunia.com/advisories/62816Not Applicable

http://secunia.com/advisories/62865Not Applicable

http://secunia.com/advisories/62870Not Applicable

http://secunia.com/advisories/62871Not Applicable

http://secunia.com/advisories/62879Not Applicable

http://secunia.com/advisories/62883Not Applicable

http://support.apple.com/kb/HT204942Third Party Advisory

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150128-ghostThird Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21695695Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21695774Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21695835Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21695860Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21696131Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21696243Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21696526Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21696600Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21696602Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21696618Third Party Advisory

http://www.debian.org/security/2015/dsa-3142Third Party Advisory

http://www.idirect.net/Partners/~/media/Files/CVE/iDirect-Posted-Common-Vulnerabilities-and-Exposures.pdfBroken LinkURL Repurposed

http://www.mandriva.com/security/advisories?name=MDVSA-2015:039Third Party Advisory

http://www.openwall.com/lists/oss-security/2021/05/04/7ExploitMailing List

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlPatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlPatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlPatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlPatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatchThird Party Advisory

http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.htmlThird Party Advisory

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlThird Party Advisory

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlThird Party Advisory

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlThird Party Advisory

http://www.securityfocus.com/bid/72325Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/91787Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1032909Third Party AdvisoryVDB Entry

http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0Broken LinkPermissions Required

https://bto.bluecoat.com/security-advisory/sa90Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-994726.pdfThird Party Advisory

https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerabilityThird Party Advisory

https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04874668Third Party Advisory

https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+FixesThird Party Advisory

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10671Third Party Advisory

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

NVD CVE.org CISA Vulners Exploit-DB GitHub PoC VulnCheck KEV GreyNoise

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin