{"id":778,"date":"2021-07-23T12:37:56","date_gmt":"2021-07-23T12:37:56","guid":{"rendered":"https:\/\/ssdsunucum.com\/blog\/cve-2015-2035-ghost\/"},"modified":"2021-07-23T12:37:56","modified_gmt":"2021-07-23T12:37:56","slug":"cve-2015-2035-ghost","status":"publish","type":"post","link":"https:\/\/ssdsunucum.com\/blog\/cve-2015-2035-ghost\/","title":{"rendered":"CVE-2015-2035-GHOST"},"content":{"rendered":"<\/p>\n
\n
<\/div>\n
\n
\n
Note:<\/div>\n
\n RESOLVED This article will receive no further updates at this time.\n <\/div>\n<\/div>\n

Background Information<\/h2>\n

On 27 January 2015, a vulnerability in all versions of the GNU C library (glibc<\/code>) was announced by Qualys. The issue was a buffer overflow during DNS hostname resolution. Disclosure of this issue was coordinated with the various operating system vendors and patches were made available by RedHat soon after the initial announcement went out.<\/p>\n

Impact<\/h2>\n

According to Qualys, this vulnerability allows unauthenticated remote code execution in any daemons or services that perform hostname lookups using the vulnerable functions in the GNU C library. This library is at the core of most services and software that runs on Linux systems.<\/p>\n

Qualys developed working attacks for the EXIM mail transport agent that all cPanel & WHM systems use. Qualys also created a Metasploit module to make testing or exploitation of the vulnerability straightforward for an attacker. At present, Qualys has not released any attack code, only detailed analysis of the flaw and its impact.<\/p>\n

How to determine if your server is affected<\/h2>\n

The updated RPMs provided by RedHat, CentOS, and CloudLinux should contain a changelog entry with the CVE number. You can check for this changelog entry with the following command: <\/p>\n

\n
rpm -<\/span>q --changelog <\/span>glibc |<\/span> grep CVE-<\/span>2015<\/span>-<\/span>0235<\/span><\/code><\/pre>\n<\/div>\n
If a changelog line appears, the server has the updated RPMs installed.<\/p>\n
Resolution<\/h2>\n
cPanel, L.L.C. does not<\/strong> provide the glibc<\/code> RPM. It is provided by the vendor of the operating system where cPanel & WHM is installed.<\/p>\n
To fix this issue, run the following commands:\n<\/p>\n
\n
yum clean all ; yum update glibc<\/code><\/pre>\n<\/div>\n
Verify the new glibc RPM was installed again:\n<\/p>\n
\n
rpm -<\/span>q --changelog <\/span>glibc |<\/span> grep CVE-<\/span>2015<\/span>-<\/span>0235<\/span><\/code><\/pre>\n<\/div>\n
Then reboot the server or manually restart all running services, as RHEL-based systems do not restart running daemons when libc<\/code> is updated. A reboot or restart of all services is needed.<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"
Note: RESOLVED This article will receive no further updates at this time. Background Information On 27 January 2015, a vulnerability in all versions of the GNU C library (glibc) was announced by Qualys. The issue was a buffer overflow during DNS hostname resolution. Disclosure of this issue was coordinated with the various operating system vendors …<\/p>\n","protected":false},"author":1,"featured_media":779,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts\/778"}],"collection":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/comments?post=778"}],"version-history":[{"count":0,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts\/778\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/media\/779"}],"wp:attachment":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/media?parent=778"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/categories?post=778"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/tags?post=778"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}