Quantum Secular Labs / Blog / Advisories

CVE-2015-0235: GNU Glibc: Buffer overflow

CVE-2015-0235 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects GNU Glibc, along with 17 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

Access vector: Network. Exploitable remotely over the network.
Access complexity: Low. No special conditions are required.
Authentication: None. No authentication is needed.
Confidentiality impact: Complete. Total information disclosure.
Integrity impact: Complete. Total loss of integrity.
Availability impact: Complete. Total shutdown of the component.

Underlying weakness

CWE-787: Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Affected products

GNU Glibc: from 2.0 before 2.18
Oracle Communications Application Session Controller: before 3.7.1
Oracle Communications Eagle Application Processor: 16.0
Oracle Communications Eagle Lnp Application Processor: 10.0
Oracle Communications Lsms: 13.1
Oracle Communications Policy Management: 9.7.3; 9.9.1; 10.4.1; 11.5; 12.1.1
Oracle Communications Session Border Controller: before 7.2.0; 7.2.0; 8.0.0
Oracle Communications User Data Repository: from 10.0.0 up to and including 10.0.1
Oracle Communications Webrtc Session Controller: 7.0; 7.1; 7.2
Oracle Exalogic Infrastructure: 1.0; 2.0
Oracle Vm Virtualbox: before 5.1.24
Oracle Linux: 5; 7 0
Debian Linux: 7.0; 8.0
Red Hat Virtualization: 6.0
Apple Mac OS X: before 10.11.1