CVE-2015-0235

Exim GHOST (glibc gethostbyname) Buffer Overflow

Title source: metasploit
STIX 2.1

Exploitation Summary

EIP tracks 21 public exploits for CVE-2015-0235. PoCs published by Qualys Corporation, 1n3, aaronfay, including Metasploit module auxiliary/scanner/http/wordpress_ghost_scanner.

AI-analyzed exploit summary This Metasploit module exploits CVE-2015-0235 (GHOST), a heap-based buffer overflow in glibc's gethostbyname functions, targeting Exim mail servers on x86/x86_64 Linux systems. It leverages specific Exim configurations and FCrDNS requirements to achieve remote code execution.

Description

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

Exploits (21)

exploitdb WORKING POC VERIFIED
by Qualys Corporation · rubyremotelinux
https://www.exploit-db.com/exploits/36421

This Metasploit module exploits CVE-2015-0235 (GHOST), a heap-based buffer overflow in glibc's gethostbyname functions, targeting Exim mail servers on x86/x86_64 Linux systems. It leverages specific Exim configurations and FCrDNS requirements to achieve remote code execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Exim (4.77 and later) with glibc (2.6 to 2.17)
No auth needed
Prerequisites: Exim with helo_try_verify_hosts or helo_verify_hosts enabled · FCrDNS for the attacker's IP · Vulnerable glibc version (2.6-2.17)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by 1n3 · pythondoslinux
https://www.exploit-db.com/exploits/35951

This exploit leverages CVE-2015-0235 (GHOST vulnerability) to trigger a buffer overflow in Exim's ESMTP service via a maliciously crafted HELO/EHLO command, causing a denial-of-service (DoS) condition.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Exim ESMTP 4.80 or less
No auth needed
Prerequisites: Network access to the Exim SMTP service · Vulnerable glibc version (GHOST)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 15 stars
by aaronfay · poc
https://github.com/aaronfay/CVE-2015-0235-test

This repository contains a scanner for CVE-2015-0235 (GHOST vulnerability), which checks if a system is vulnerable to a heap-based buffer overflow in the GNU C Library's gethostbyname functions. The PoC attempts to trigger the vulnerability and checks for a canary overwrite to determine vulnerability status.

Classification
Scanner 100%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: GNU C Library (glibc) versions before 2.18
No auth needed
Prerequisites: Access to a system with vulnerable glibc version · gcc installed for compilation
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 6 stars
by makelinux · poc
https://github.com/makelinux/CVE-2015-0235-workaround

This repository contains a proof-of-concept exploit for CVE-2015-0235 (GHOST vulnerability) in glibc, which involves a heap-based buffer overflow in the gethostbyname_r and gethostbyname2_r functions. It includes a test program (GHOST2.c) to check for vulnerability and a shared library wrapper (gethostbyname_wrap.c) as a workaround.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: glibc (versions before 2.18)
No auth needed
Prerequisites: Target system must be running a vulnerable version of glibc (pre-2.18)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 6 stars
by fser · poc
https://github.com/fser/ghost-checker

This PoC checks for the GHOST vulnerability (CVE-2015-0235) by exploiting a buffer overflow in the gethostbyname_r function. It verifies if the canary value is overwritten, indicating vulnerability.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: glibc (versions before 2.18)
No auth needed
Prerequisites: Access to a system running vulnerable glibc
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 4 stars
by arm13 · poc
https://github.com/arm13/ghost_exploit

This repository contains a Python and Ruby exploit for CVE-2015-0235 (GHOST vulnerability), targeting Exim SMTP servers. The exploit triggers a buffer overflow in the gethostbyname() function, causing a denial-of-service (DoS) condition.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Exim SMTP servers (version 4.20 or less)
No auth needed
Prerequisites: Network access to the target SMTP server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 3 stars
by mikesplain · poc
https://github.com/mikesplain/CVE-2015-0235-cookbook

This repository contains a Chef cookbook designed to test for CVE-2015-0235 (GHOST vulnerability) in glibc. It compiles and runs a C program that checks if the system's libc is vulnerable to a buffer overflow in the gethostbyname_r function.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: glibc (versions before 2.18)
No auth needed
Prerequisites: Access to a system with glibc installed · GCC to compile the test program
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by nickanderson · poc
https://github.com/nickanderson/cfengine-CVE_2015_0235

This PoC exploits CVE-2015-0235 (GHOST), a heap-based buffer overflow in the GNU C Library's gethostbyname functions. It checks for vulnerability by triggering the overflow and verifying a canary value is overwritten.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: glibc (versions 2.2 to 2.17)
No auth needed
Prerequisites: Target system must be using a vulnerable version of glibc
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by adherzog · poc
https://github.com/adherzog/ansible-CVE-2015-0235-GHOST

This PoC tests for CVE-2015-0235 (GHOST), a heap-based buffer overflow in glibc's gethostbyname* functions. It checks if the canary value is overwritten, indicating vulnerability.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: glibc (versions before 2.18)
No auth needed
Prerequisites: Access to a system with vulnerable glibc
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by furyutei · poc
https://github.com/furyutei/CVE-2015-0235_GHOST

This PoC tests for CVE-2015-0235 (GHOST), a heap-based buffer overflow in glibc's gethostbyname* functions. It attempts to overflow a buffer using a crafted hostname and checks for canary corruption to determine vulnerability.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: glibc (versions before 2.18)
No auth needed
Prerequisites: System with vulnerable glibc version
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER
by chayim · poc
https://github.com/chayim/GHOSTCHECK-cve-2015-0235

This is a Fabric-based scanner for detecting CVE-2015-0235 (GHOST) vulnerability in glibc versions. It checks the glibc version and build date on remote Linux hosts via SSH to determine if they are vulnerable.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: glibc (versions 2.2 to 2.17 before 2013-05-22, and 2.18 before 2015-01-28)
Auth required
Prerequisites: SSH access to target systems · Fabric installed on the attacker's machine
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER
by sUbc0ol · poc
https://github.com/sUbc0ol/CVE-2015-0235

This PoC is a scanner for CVE-2015-0235 (GHOST vulnerability) in WordPress XMLRPC. It sends a crafted pingback request with a long host header to trigger a buffer overflow, checking for vulnerability based on the server's response.

Classification
Scanner 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: WordPress (with XMLRPC enabled)
No auth needed
Prerequisites: Target URL with XMLRPC endpoint
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WORKING POC
by gitcollect · cpoc
https://github.com/gitcollect/CVE_Exploits/tree/master/cve-2015-0235

This PoC exploits CVE-2015-0235 (GHOST), a heap-based buffer overflow in the GNU C Library's gethostbyname* functions. It checks for vulnerability by overflowing a buffer and detecting canary corruption.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: glibc (versions 2.2 to 2.17)
No auth needed
Prerequisites: target system with vulnerable glibc version
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC
by alanmeyer · poc
https://github.com/alanmeyer/CVE-glibc

This repository contains a proof-of-concept exploit for CVE-2015-0235 (GHOST), a heap-based buffer overflow in the GNU C Library (glibc) gethostbyname functions. It includes a C-based exploit (GHOST.c) to test vulnerability and a shell script (GHOST-test.sh) to check glibc versions for vulnerability.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: glibc versions before 2.18
No auth needed
Prerequisites: Target system must be running a vulnerable version of glibc (< 2.18)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by F88 · poc
https://github.com/F88/ghostbusters15

This repository contains Ansible playbooks and shell scripts to mitigate CVE-2015-0235 (GHOST vulnerability) by updating the glibc package on affected systems. The scripts log their actions and check for installed packages.

Classification
Working Poc 90%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: glibc (versions affected by CVE-2015-0235)
Auth required
Prerequisites: access to a vulnerable system with sudo privileges · yum package manager
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER
by 1and1-serversupport · poc
https://github.com/1and1-serversupport/ghosttester

This repository contains a scanner for CVE-2015-0235 (GHOST vulnerability in glibc). It includes a C program and a shell script to test for the vulnerability by checking glibc versions and exploiting a buffer overflow in gethostbyname_r.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: glibc versions before 2.18
No auth needed
Prerequisites: Access to the target system to run the scanner
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by tobyzxj · poc
https://github.com/tobyzxj/CVE-2015-0235

This PoC exploits CVE-2015-0235 (GHOST), a heap-based buffer overflow in glibc's gethostbyname functions. It checks for vulnerability by triggering the overflow and verifying canary corruption.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: glibc (versions before 2.18)
No auth needed
Prerequisites: Target system running vulnerable glibc version
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by koudaiii-archives · poc
https://github.com/koudaiii-archives/cookbook-update-glibc

This repository contains a Chef cookbook for detecting and patching CVE-2015-0235 (GHOST), a heap-based buffer overflow in glibc's gethostbyname functions. It includes a PoC exploit (GHOST.c) to check vulnerability status and recipes to update glibc on Ubuntu/CentOS.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: glibc (versions before 2.18)
No auth needed
Prerequisites: Access to a vulnerable glibc version · Ability to compile and execute the PoC
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB
by favoretti · poc
https://github.com/favoretti/lenny-libc6

The repository contains only a README.md file with minimal content, providing no functional exploit code or technical details for CVE-2023-4879. It appears to be a placeholder or incomplete submission.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
by Robert Rowley, Christophe De La Fuente, Chaim Sanders, Felipe Costa, Jonathan Claudius, Karl Sigler, Christian Mehlmauer · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wordpress_ghost_scanner.rb

This Metasploit module scans for the GHOST vulnerability (CVE-2015-0235) in WordPress by sending a malformed XMLRPC request. It checks if the target system crashes (indicating vulnerability) or returns a normal error (indicating patched).

Classification
Scanner 100%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: WordPress with XMLRPC enabled (glibc vulnerability)
No auth needed
Prerequisites: WordPress installation with XMLRPC enabled · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC GREAT
by Unknown · rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/smtp/exim_gethostbyname_bof.rb

This Metasploit module exploits CVE-2015-0235 (GHOST), a heap-based buffer overflow in glibc's gethostbyname functions, targeting Exim mail servers on x86/x86_64 Linux systems. It achieves remote code execution by leveraging a crafted SMTP HELO command to overflow the buffer and manipulate heap metadata.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Racy
Target: Exim (with vulnerable glibc versions)
No auth needed
Prerequisites: Network access to Exim SMTP port (25) · Vulnerable glibc version (pre-patch for CVE-2015-0235)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (90)

Core 90
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/72325
Issue Tracking, Mailing List, Third Party Advisory vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=142296726407499&w=2
Third Party Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21696131
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62883
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62691
Mailing List, Third Party Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html
Issue Tracking, Mailing List, Third Party Advisory vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=142722450701342&w=2
Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq
http://seclists.org/oss-sec/2015/q1/269
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62698
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62640
Patch, Third Party Advisory x_refsource_confirm
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
Third Party Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21696618
Third Party Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21696600
Mailing List, Third Party Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62688
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62865
Third Party Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21696243
Issue Tracking, Mailing List, Third Party Advisory vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=142721102728110&w=2
Mailing List, Third Party Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html
Patch, Third Party Advisory x_refsource_confirm
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62812
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62879
Issue Tracking, Mailing List, Third Party Advisory vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=142781412222323&w=2
Third Party Advisory x_refsource_confirm
http://linux.oracle.com/errata/ELSA-2015-0090.html
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62871
Patch, Third Party Advisory x_refsource_confirm
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62690
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62692
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62681
Third Party Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21696526
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62667
Third Party Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2015:039
Third Party Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21696602
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62517
Third Party Advisory x_refsource_confirm
http://support.apple.com/kb/HT204942
Third Party Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21695695
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62680
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62813
Patch, Third Party Advisory x_refsource_confirm
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/91787
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/130171/Exim-ESMTP-GHOST-Denial-Of-Service.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0126.html
Patch, Third Party Advisory x_refsource_confirm
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
Exploit, Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/534845/100/0/threaded
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62715
Third Party Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21695835
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq
http://seclists.org/oss-sec/2015/q1/274
Issue Tracking, Mailing List, Third Party Advisory vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=143145428124857&w=2
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2015/Jan/111
Third Party Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21695774
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62870
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20150127-0001/
Third Party Advisory x_refsource_confirm
http://linux.oracle.com/errata/ELSA-2015-0092.html
Third Party Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21695860
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2015/dsa-3142
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62816
Not Applicable third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62758
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2019/Jun/18
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2019/Jun/14
Third Party Advisory x_refsource_confirm
https://cert-portal.siemens.com/productcert/pdf/ssa-994726.pdf
Exploit, Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/05/04/7
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2021/Sep/0
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2022/Jun/36
Third Party Advisory x_refsource_confirm
https://support.apple.com/HT205375
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1032909
Third Party Advisory x_refsource_confirm
https://bto.bluecoat.com/security-advisory/sa90
Third Party Advisory x_refsource_confirm
https://www.sophos.com/en-us/support/knowledgebase/121879.aspx
Third Party Advisory x_refsource_confirm
https://kc.mcafee.com/corporate/index?page=content&id=SB10100
Third Party Advisory x_refsource_confirm
https://support.apple.com/HT205267
Third Party Advisory x_refsource_confirm
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10671
Third Party Advisory x_refsource_confirm
https://www.f-secure.com/en/web/labs_global/fsc-2015-1
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201503-04

Scores

EPSS 0.9486
EPSS Percentile 99.8%

Details

CWE
CWE-787
Status published
Products (31)
apple/mac_os_x < 10.11.1
debian/debian_linux 7.0
debian/debian_linux 8.0
gnu/glibc 2.0 - 2.18
ibm/pureapplication_system 1.0.0.0
ibm/pureapplication_system 1.1.0.0
ibm/pureapplication_system 2.0.0.0
ibm/security_access_manager_for_enterprise_single_sign-on 8.2
oracle/communications_application_session_controller < 3.7.1
oracle/communications_eagle_application_processor 16.0
... and 21 more
Published Jan 28, 2015
Tracked Since Feb 18, 2026