CVE-2015-0235

Exim GHOST (glibc gethostbyname) Buffer Overflow

Title source: metasploit

Description

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

Exploits (21)

nomisec SCANNER 15 stars
by aaronfay · poc
https://github.com/aaronfay/CVE-2015-0235-test
nomisec WORKING POC 6 stars
by makelinux · poc
https://github.com/makelinux/CVE-2015-0235-workaround
nomisec WORKING POC 6 stars
by fser · poc
https://github.com/fser/ghost-checker
nomisec WORKING POC 4 stars
by arm13 · poc
https://github.com/arm13/ghost_exploit
nomisec SCANNER 3 stars
by mikesplain · poc
https://github.com/mikesplain/CVE-2015-0235-cookbook
nomisec WORKING POC 1 stars
by furyutei · poc
https://github.com/furyutei/CVE-2015-0235_GHOST
nomisec WORKING POC 1 stars
by adherzog · poc
https://github.com/adherzog/ansible-CVE-2015-0235-GHOST
nomisec WORKING POC 1 stars
by nickanderson · poc
https://github.com/nickanderson/cfengine-CVE_2015_0235
nomisec SCANNER
by chayim · poc
https://github.com/chayim/GHOSTCHECK-cve-2015-0235
nomisec STUB
by favoretti · poc
https://github.com/favoretti/lenny-libc6
nomisec WORKING POC
by koudaiii-archives · poc
https://github.com/koudaiii-archives/cookbook-update-glibc
nomisec SCANNER
by 1and1-serversupport · poc
https://github.com/1and1-serversupport/ghosttester
nomisec WORKING POC
by F88 · poc
https://github.com/F88/ghostbusters15
nomisec WORKING POC
by alanmeyer · poc
https://github.com/alanmeyer/CVE-glibc
nomisec WORKING POC
by tobyzxj · poc
https://github.com/tobyzxj/CVE-2015-0235
nomisec SCANNER
by sUbc0ol · poc
https://github.com/sUbc0ol/CVE-2015-0235
github WORKING POC
by gitcollect · cpoc
https://github.com/gitcollect/CVE_Exploits/tree/master/cve-2015-0235
metasploit SCANNER
by Robert Rowley, Christophe De La Fuente, Chaim Sanders, Felipe Costa, Jonathan Claudius, Karl Sigler, Christian Mehlmauer · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wordpress_ghost_scanner.rb
exploitdb WORKING POC
by 1n3 · pythondoslinux
https://www.exploit-db.com/exploits/35951
metasploit WORKING POC GREAT
by Unknown · rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/smtp/exim_gethostbyname_bof.rb
exploitdb WORKING POC VERIFIED
by Qualys Corporation · rubyremotelinux
https://www.exploit-db.com/exploits/36421

References (90)

... and 70 more

Scores

EPSS 0.8666
EPSS Percentile 99.4%

Classification

CWE
CWE-787
Status draft

Affected Products (31)

gnu/glibc < 2.18
oracle/communications_application_session_controller < 3.7.1
oracle/communications_eagle_application_processor
oracle/communications_eagle_lnp_application_processor
oracle/communications_lsms
oracle/communications_policy_management
oracle/communications_policy_management
oracle/communications_policy_management
oracle/communications_policy_management
oracle/communications_policy_management
oracle/communications_session_border_controller < 7.2.0
oracle/communications_session_border_controller
oracle/communications_session_border_controller
oracle/communications_user_data_repository < 10.0.1
oracle/communications_webrtc_session_controller
... and 16 more

Timeline

Published Jan 28, 2015
Tracked Since Feb 18, 2026