PHP Applications and WordPress exposed to the Ghost flaw

Pierluigi Paganini January 31, 2015

PHP applications and WordPress CMS might be affected by the GHOST vulnerability that could be exploit to compromise the hosting servers.

The critical GHOST vulnerability (CVE-2015-0235) in the GNU C library (glibc) may have a greater impact than imagined, security experts have discovered that PHP applications, including the popular WordPress Content Management System (CMS), could also be affected by the flaw.

The vulnerability is present in all Linux systems dating back to 2000 and could be exploited by attackers to execute code and remotely gain control of Linux machines.

The vulnerability was first discovered by researchers at Qualys and it affects the glibc function “GetHOSTbyname().” Fortunately the mitigation is quite easy, the major Linux distributors, including Debian, Red Hat and Ubuntu, have already issued security updates for their software.

As highlighted by the experts, the PHP applications including WordPress also refers the gethostbyname() function wrapper, exposing the users of the popular CMS to the risk of hack.

“We also have good reasons to believe PHP applications might also be affected, through its gethostbyname() function wrapper. An example of where this could be a big issue is within WordPress itself: it uses a function named wp_http_validate_url() to validate every pingback’s post URL:” states the Sucuri researcher Marc-Alexandre Montpas

GHOST vulnerability represents a serious threat for WordPress CMS that invoke gethostbyname() function wrapper when uses the function wp_http_validate_url () to validate pingbacks.

“So an attacker could leverage this vector to insert a malicious URL that would trigger a buffer overflow bug, server-side, potentially allowing him to gain privileges on the server.” continues the post.

Sucuri GetHostbyName GHOST flaw

The vulnerability affects all versions of glibc from glibc-2.17 and lower. However, it was patched in glibc-2.18 in May 2013, but was not marked as a security vulnerability so the fix did not make it into many common Linux distributions like RedHat and Ubuntu.

Sucuri invites all administrators of dedicated servers and virtual private servers running Linux OS to update the flawed library.

“If you have a dedicated server (or VPS) running Linux, you have to make sure you update it right away.” Montpas said.

Administrators can run the following code on their systems to discover if they are affected by the GHOST vulnerability:

php -r '$e="0″;for($i=0;$i<2500;$i++){$e="0$e";} gethostbyname($e);' Segmentation fault

If the system is vulnerable, administrators have to update their servers with software updates provided by Linux distributions.

The experts also recommend disabling the XML-RPC process and Pingback Requests to reduce the surface of attack.

Admin can disable the pingback feature by adding the following code to their functions.php file:

add_filter( 'xmlrpc_methods' , function( $methods' ) { unset( $methods[ 'pingback.ping ] ); return $methods; } );

Pierluigi Paganini

(Security Affairs – GHOST vulnerability, WordPress)



you might also like

leave a comment