GNU C Library (glibc) __nss_hostname_digits_dots() function vulnerable to buffer overflow ("GHOST")

Lenovo Security Advisory: LEN-2015-007

Potential Impact: Execution of Arbitrary Code

Severity: High

Summary:
A vulnerability has been found in the GNU C Library (glibc) __nss_hostname_digits_dots() function that allows both local and remote users to cause a buffer overflow in network function calls gethostbyname() and gethostbyname2(). The media is referring to this vulnerability as “GHOST.”

Immediate patches are required to fix the vulnerability in the glibc that allow arbitrary code execution from unauthenticated users. It is necessary to restart computers or process following the patches.

Description:
According to Qualys, the vulnerability is “a buffer overflow in the _ _nss_hostname_digits_dots() function of the GNU C Library (glibc). This bug is reachable both locally and remotely via the gethostbyname*() functions” and furthermore, “arbitrary code execution can be achieved” by use of the buffer overflow. The vulnerability exists in any systems relying on the function in the GNU C Library gethostbyname() and gethostbyname2() functions. There is currently proof of concept code available to exploit this code.

Affected Products:

ThinkPad

ThinkCentre

ThinkStation

ThinkServer & Storage

System | Status | Minimum version
including Fix | Link
—|—|—|—
ThinkServer RD330 | Not affected | − | −
ThinkServer RD340 | Not affected | − | −
ThinkServer RD350 | Affected | 1.33 | <http://support1.lenovo.com.cn/lenovo/wsi/Modules/DriverDetailServer.aspx?ID=70692&gt;
ThinkServer RD430 | Not affected | − | −
ThinkServer RD440 | Not affected | − | −
ThinkServer RD450 | Affected | 1.33 | <http://support1.lenovo.com.cn/lenovo/wsi/Modules/DriverDetailServer.aspx?ID=70693&gt;
ThinkServer RD530 | Not affected | − | −
ThinkServer RD540 | Not affected | − | −
ThinkServer RD550 | Affected | 1.33 | <http://support1.lenovo.com.cn/lenovo/wsi/Modules/DriverDetailServer.aspx?ID=70694&gt;
ThinkServer RD630 | Not affected | − | −
ThinkServer RD640 | Not affected | − | −
ThinkServer RD650 | Affected | 1.33 | <http://support1.lenovo.com.cn/lenovo/wsi/Modules/DriverDetailServer.aspx?ID=70695&gt;
ThinkServer RS140 | Not affected | − | −
ThinkServer TD340 | Not affected | − | −
ThinkServer TD350 | Affected | 1.33 | <http://support1.lenovo.com.cn/lenovo/wsi/Modules/DriverDetailServer.aspx?ID=70696&gt;
ThinkServer TS130 | Not affected | − | −
ThinkServer TS140 | Not affected | − | −
ThinkServer TS430 | Not affected | − | −
ThinkServer TS440 | Not affected | − | −
ThinkStorage SA120 | Not affected | − | −

Lenovo EMC

Software

Acknowledgements:

Other information and references:

• CERT Vulnerability Note: VU#967332
• CVE ID: CVE-2015-0235

Revision History: