GHOST - CVE-2015-0235

A vulnerability (CVE-2015-0235) named "GHOST" has been discovered and is a serious weakness in the Linux GLibC library. It allows attackers to locally and remotely take complete control of the affected system without having any prior knowledge of system credentials by using the (1) gethostbyname or (2) gethostbyname2 functions to trigger a buffer overflow in the __nss_hostname_digits_dots() function in glibc 2.2, and other 2.x versions before 2.18.

 

For all LoadMaster hardware appliances, VLM's, and Cloud LoadMasters: 

KEMP has determined that although all of its current LoadMaster products contain vulnerable versions of GLibC, the specific functions that can cause compromise (GetHostByName, GetHostByName2) are not directly referenced in any of them. Active monitoring of developments around this vulnerability are ongoing

For Application Firewall Pack (AFP) only:

KEMP has determined that the specific functions that can cause compromise (GetHostByName, GetHostByName2) are directly referenced by Apache components within AFP, however, per the original Qualys vulnerability disclosure, it does not appear that the buffer overflow can be triggered:

"Here is a list of potential targets that we investigated (they all call
gethostbyname, one way or another), but to the best of our knowledge,
the buffer overflow cannot be triggered in any of them:

apache, cups, dovecot, gnupg, isc-dhcp, lighttpd, mariadb/mysql,
nfs-utils, nginx, nodejs, openldap, openssh, postfix, proftpd,
pure-ftpd, rsyslog, samba, sendmail, sysklogd, syslog-ng, tcp_wrappers,
vsftpd, xinetd.”

Active monitoring of developments around this vulnerability are ongoing.

 

For further information on this vulnerability please see

http://seclists.org/oss-sec/2015/q1/283

https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability

 

KEMP is committed to resolving security vulnerabilities carefully and quickly.  If you think you have found a security flaw in a KEMP product, please send all supporting information to securityalert@kemptechnologies.com.

Was this article helpful?

0 out of 0 found this helpful

Comments