Security bulletin: “Ghost” vulnerability on Linux devices

Recently a critical security bug has been found with the Name Service Switch (nss) library in almost all Linux distributions. This bug can allow attackers to gain access to affected systems remotely by possibility to remotely execute arbitrary machine code without permissions.

Information on this bug and how it can be resolved can be found below. Edpnet has already patched this vulnerability on all of its servers, and we strongly advice our customers to do the same.

A heap-based buffer overflow was found in glibc’s __nss_hostname_digits_dots() function, which is used by the gethostbyname() and gethostbyname2() glibc function calls. A remote attacker able to make an application call either of these functions could use this flaw to execute arbitrary code with the permissions of the user running the application.

Source and info: http://ma.ttias.be

^{*All times are listed in CET, Central European Time}