Tenable Responds to CVE-2015-0235: GHOST (Updated)
A major vulnerability was disclosed today in the GNU C Library (“glibc”). CVE-2015-0235, known as “GHOST” in the media, affects Linux systems that use versions of the library prior to glibc-2.18, which was released on August 12, 2013. The GNU C Library is commonly used for standard system calls by programs written in C and C++. The vulnerability is a heap-based buffer overflow which affects the gethostbyname() and gethostbyname2() glibc function calls. A remote attacker who is able to make an application call with either of these functions could use this flaw to execute arbitrary code with the permissions of the user running the application.
Update: Nessus plugins
Impacted operating system vendors are making updates available, and Tenable has released a series of local Nessus® plugins to detect the presence of affected versions of glibc:
| Distribution | Plugin |
|---|---|
| Amazon Linux AMI | 81024 |
| CentOS 5 | 81025 |
| CentOS 6 & 7 | 81026 |
| Debian 7 | 81029 |
| FreeBSD | 81062 |
| OracleVM 2.2 | 81119 |
| OracleVM 3.2 | 81118 |
| OracleVM 3.3 | 81103 |
| Oracle Linux 4 | 81099 |
| Oracle Linux 5 | 81044 |
| Oracle Linux 6 & 7 | 81031 |
| Red Hat Enterprise Linux 4 | 81104 |
| Red Hat Enterprise Linux 5 | 81033 |
| Red Hat Enterprise Linux 6 & 7 | 81034 |
| RHEL 5.6/5.9/6.2/6.4/6.5 Long Life/Advanced Support/Extended Support | 81068 |
| Scientific Linux 5 | 81037 |
| Scientific Linux 6 & 7 | 81038 |
| Slackware 13.0/13.1/13.37/14.0/14.1/current | 81075 |
| SUSE Linux Enterprise 11 | 81039 |
| Ubuntu 10.04 & 12.04 | 81042 |
You can also watch a video about Detecting GHOST with Nessus.
Update: SecurityCenter dashboard
A customized SecurityCenter™ dashboard to monitor, track and remediate critical assets affected by CVE-2015-0235 is available via the feed to provide insight on the impact to your environment and the progress of your efforts to remediate the issue.
You can also watch a video about Detecting GHOST with SecurityCenter.
This blog will be updated as events occur. And visit Tenable's GHOST Vulnerability page for more information.
Related Articles
Consolidate and Unify to Accelerate Your Security Efforts
October 13, 2022CISOs want to shrink their cybersecurity tool stack and see improved interoperability among products so that they can draw actionable insights from uniform and normalized data. Here we explain why this is key for understanding your environment’s security posture and empowering you to make better decisions about mitigating risk.
Narrow Focus on CVEs Leaves Organizations Vulnerable to Attacks
October 21, 2021CWEs and other vulnerabilities necessitate a single dashboard for complete cyber risk assessment A growing number of cybersecurity professionals have evolved their legacy vulnerability manageme...
Outstanding Patch Tracking Dashboard
February 7, 2017Editor's note: Our dashboards have been updated in the time since this blog was originally published. Please see this page for the latest guidance on Outstanding Remediation Tracking. The IT Operat...
Want to Learn More about Exposure Management? Check Out This Gartner® Report
June 6, 2023At Tenable, we believe that you need exposure management to protect your modern attack surface. But it’s not just us. We feel the Gartner “Predicts 2023: Enterprises Must Expand from Threat to Exposure Management” report is required reading for cybersecurity teams adopting an exposure management program and platform.
Tenable Cyber Watch: China’s ‘Volt Typhoon’ Targets U.S. Critical Infrastructure, BEC Attacks Skyrocket, and more
June 5, 2023This week’s edition of the Tenable Cyber Watch unpacks the White House’s updates to its National AI R&D Strategic Plan and addresses the recent surge in business email compromise scams. Also covered: CISA’s warning about Volt Typhoon, the hackers backed by the Chinese government that have been targeting U.S. critical infrastructure.
CVE-2023-34362: MOVEIt Transfer Critical Zero-Day Vulnerability Exploited in the Wild
June 2, 2023Discovery of a new zero-day vulnerability in MOVEit Transfer becomes the second zero-day disclosed in a managed file transfer solution in 2023, with reports suggesting that threat actors have stolen data from a number of organizations.
- Dashboards
- Nessus
- Plugins
- SecurityCenter