Tenable Responds to CVE-2015-0235: GHOST (Updated)

A major vulnerability was disclosed today in the GNU C Library (“glibc”). CVE-2015-0235, known as “GHOST” in the media, affects Linux systems that use versions of the library prior to glibc-2.18, which was released on August 12, 2013. The GNU C Library is commonly used for standard system calls by programs written in C and C++. The vulnerability is a heap-based buffer overflow which affects the gethostbyname() and gethostbyname2() glibc function calls. A remote attacker who is able to make an application call with either of these functions could use this flaw to execute arbitrary code with the permissions of the user running the application.

Update: Nessus plugins

Impacted operating system vendors are making updates available, and Tenable has released a series of local Nessus® plugins to detect the presence of affected versions of glibc:

You can also watch a video about Detecting GHOST with Nessus.

Update: SecurityCenter dashboard

A customized SecurityCenter™ dashboard to monitor, track and remediate critical assets affected by CVE-2015-0235 is available via the feed to provide insight on the impact to your environment and the progress of your efforts to remediate the issue.

You can also watch a video about Detecting GHOST with SecurityCenter.

This blog will be updated as events occur. And visit Tenable's GHOST Vulnerability page for more information.