Scan Finds Ghost Haunting Critical Business Applications

Some 41% of enterprise applications using GNU C Library (glibc) employ the Ghost-ridden gethostbyname function, Veracode discovers.

Ghost is alive and well in many critical business applications, suggesting the vulnerability may be more pervasive than originally thought, new data shows.
Application security vendor Veracode found in its cloud-based scanning service that 41% of its customers enterprise applications that use the GNU C library, aka glibc, call the Ghost-ridden gethostbyname function.
Ghost--CVE-2015-0235--is a serious buffer overflow vulnerability affecting various Linux systems
. The flaw in Linuxs glibc could allow an attacker to remotely wrest control of a system without authenticating to it to insert malware, or to wage distributed denial-of-service attacks, for instance. Its found in various Linux appliances and affects Debian 7, Red Hat Enterprise Linux 6 and 7, CentOS 6 and 7, and Ubuntu 12.04, as well as other Linux implementations. Glibc versions 2.2 through 2.17 are vulnerable to Ghost. All of the known affected Linux systems now have patches available.
Veracode says some 80% of those applications it analyzed using glibc were rated as highly business-critical by the organizations, which indicates they may be financial transaction applications or others that access sensitive databases.
The pervasiveness [of Ghost, we found] was kind of surprising, says Chris Wysopal, CTO of Veracode. When the bug was first revealed last month by Qualys, the good news was that it was an old function, so newer systems were likely safe, he says.
But theres a lot of old software out there that is running it, he says.
Ghost may affect more types of systems that originally thought, too: Veracode also found that while 72% of the potentially Ghost-vulnerable applications were written in C or C++, which has been associated with Ghost, others they saw were written in Java, .NET, and PHP, programming languages.
The good news, still, is that exploiting Ghost isnt simple, as many experts have pointed out, and its not a one-size-fits-all attack. If you look at the way Ghost exploitation is presenting itself, it was very different in every application, Wysopal says. It depends on how the application is using IP addresses and hostname lookups, and the way its calling gethostbyname.
That means any Ghost attacks would most likely be targeted, and most likely be by sophisticated attackers since the bug is so implementation-dependent. This [type of attacker] will fingerprint the software you have exposed on a desktop or on the Net, and get that software and check it out and [see] if its vulnerable, he says.
Wolfgang Kandek, CTO at Qualys, recently told Dark Reading that while exploitable prospects arent necessarily easy to find, there were indeed likely others out there. Ghost has multiple remote vectors, [and] we only know of one so far, he says, referring to the Ghost proof-of-concept his team demonstrated exploiting the Exim mail server.
Veracodes advice: keep all Internet-facing systems at the latest patch level. Dont try to figure out if youre vulnerable or not. Just patch, Wysopal says. As for Linux-based appliances and other embedded devices that may not get patches, or systems behind your firewall, it wont be so simple. They might not be as easy to patch, he says.
Ghost is the latest in a string of big open-source software bugs that have been disclosed over the past year or so. It wont be the last, either, according to Wysopal, since there are so many open-source components being used today in software.
Were going to see more of the more critical vulnerabilities. This is definitely not going away, he says. Know what components youre using in your organization, and applications youre writing or building, and track them so youre ready to respond when a vulnerability becomes public.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Scan Finds Ghost Haunting Critical Business Applications