A critical vulnerability, referred to as “GHOST,” has been identified within the GNU C Library (glibc), an essential component found in numerous Linux distributions. This flaw poses a significant risk, as it allows potential attackers to remotely execute malicious code on Linux systems, which could lead to outright control of affected servers.
Discovered by security researchers from Qualys, a firm based in Redwood Shores, California, this vulnerability is documented under CVE-2015-0235. The seriousness of GHOST is underscored by comparisons to the Heartbleed and Shellshock vulnerabilities, which also led to widespread concerns about the security of Linux-based systems.
The exploitability of GHOST is alarming, as hackers could leverage it to gain unmitigated access to targeted systems without prior knowledge of administrative credentials. This level of exploitation represents a significant threat in the digital landscape, echoing the risks highlighted by previous vulnerabilities such as Heartbleed, Shellshock, and Poodle.
The term “GHOST” derives from the specific functions within glibc—the gethostbyname family—that can be exploited through a heap-based buffer overflow originating from the __nss_hostname_digits_dots() function. This particular function is invoked during calls to _gethostbyname and gethostbyname2. Researchers indicate that an attacker can remotely trigger these functions, enabling them to execute arbitrary code with the permissions of the user running the application.
To illustrate the risks posed by GHOST, researchers have developed proof-of-concept exploit code capable of executing a full remote code execution attack against the Exim mail server. Notably, this exploit can bypass existing security mechanisms, including Address Space Layout Randomization (ASLR), Position Independent Executables (PIE), and No Execute (NX) protections, across both 32-bit and 64-bit architectures.
Using the exploit, attackers could craft malicious emails designed to compromise vulnerable servers without the need for the emails to be opened. As confirmed by Amol Sarwate, Qualys’s engineering director, this presents a significant vector for undetected attacks. Although the exploit code has not yet been made publicly available, Qualys has indicated plans to integrate it into a Metasploit module for future accessibility.
The vulnerability impacts a broad range of glibc versions dating back to glibc-2.2, released in 2000. Unfortunately, this flaw went unrecognized as a security threat for an extended period, leaving many long-term stable distributions, including Debian 7, Red Hat Enterprise Linux 6 and 7, and Ubuntu 12.04, susceptible to attack.
In light of this discovery, major Linux distributors such as Red Hat, Debian, and Ubuntu have announced updates aimed at addressing the severity of the GHOST vulnerability. System updates will require rebooting either core functions or the entire affected server. Red Hat has emphasized the importance of updating systems promptly to mitigate potential risks associated with this vulnerability, urging customers to take immediate action.
In assessing the GHOST vulnerability through the MITRE ATT&CK framework, adversary tactics such as initial access and privilege escalation come to the forefront, as attackers leverage this flaw to gain unauthorized access and higher-level permissions on compromised systems. The ongoing risks associated with GHOST reiterate the necessity for continuous vigilance and proactive security measures in managing Linux environments.