HTTP: Wordpress CVE-2015-0235 glibc Hostname RCE

This signature detects an attempt to exploit a known vulnerability in WordPress while passing the hostname value as an argument to "GetHOSTbyname" function which is being implemented in glibc library. Successful exploitation could allow an attacker to craft a malicious arbitrary string and could lead to further attacks.

Extended Description

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

Affected Products

Php php

References

CVE: CVE-2015-0235

URL: https://access.redhat.com/articles/1332213 https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability

Short Name

HTTP:PHP:GHOST-GLIBC-WP

Severity

Major

Recommended

True

Recommended Action

Drop

HTTP: Wordpress CVE-2015-0235 glibc Hostname RCE

Extended Description

Affected Products

References

Found a potential security threat?