Cisco Security Advisory: GNU glibc gethostbyname Function Buffer Overflow Vulnerability

Cisco Security Advisory: GNU glibc gethostbyname Function Buffer Overflow Vulnerability

Advisory ID: cisco-sa-20150128-ghost

Revision 1.0

For Public Release 2015 January 28 22:30  UTC (GMT)

+-----------------------------------------------------------
----------

Summary
=======

On January 27, 2015, a buffer overflow vulnerability in the GNU C library (glibc) was publicly announced. This vulnerability is related to the various gethostbyname functions included in glibc and affect applications that call these functions. This vulnerability may allow an attacker to obtain sensitive information from an exploited system or, in some instances, perform remote code execution with the privileges of the application being exploited.

The glibc library is a commonly used third-party software component that is released by the GNU software project and a number of Cisco products are likely affected.

This advisory will be updated as additional information becomes available. Cisco will release free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150128-ghost