topic RE: VN-2015-001 – “GHOST” – CVE-2015-0235 in General Discussion

VN-2015-001 – “GHOST” – CVE-2015-0235

Drew_C — Fri, 30 Jan 2015 06:47:00 GMT

Summary
A serious vulnerability has been discovered in two legacy functions that are related to DNS resolution in glibc. Due to the fact that glibc is a fundamental OS component used by many pieces of "userland" software, this vulnerability is a high priority for remediation.

Background (From the CVE Project)
There is a heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18. This allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST.”

Published
2015-01-27

CVSS Severity
10 (from NVD/NIST)

Additional information and product vulnerability status can be found here:
http://learn.extremenetworks.com/rs/extreme/images/VN-2015-001_GHOST_CVE-2015-0235.pdf

The above linked PDF will be updated as we receive more information.

RE: VN-2015-001 – “GHOST” – CVE-2015-0235

Ronald_Dvorak — Mon, 22 Feb 2016 18:19:00 GMT

Drew is that the same issue ?
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7547

Thx,
Ron

RE: VN-2015-001 – “GHOST” – CVE-2015-0235

Drew_C — Mon, 22 Feb 2016 18:19:00 GMT

Ron, CVE-2015-7547 is a different issue. It looks like we'll have a first response out later today or tomorrow, which I'll share a link to. Thanks for asking!

-Drew

RE: VN-2015-001 – “GHOST” – CVE-2015-0235

Ronald_Dvorak — Mon, 22 Feb 2016 18:19:00 GMT

Drew, any update on that issue ?

Thx,
Ron

RE: VN-2015-001 – “GHOST” – CVE-2015-0235

Drew_C — Mon, 22 Feb 2016 18:19:00 GMT

Ron, we have published VN-2006-003 to address this new glibc vulnerability.
https://community.extremenetworks.com/extreme/topics/vn-2016-003-glibc-vulnerability-cve-2015-7547

RE: VN-2015-001 – “GHOST” – CVE-2015-0235

Ronald_Dvorak — Mon, 22 Feb 2016 18:19:00 GMT

Thx