THE LINUX KERNEL is affected by a security vulnerability that can be bypassed by an email to gain access to a victim's computer.
The buffer overflow-type vulnerability was discovered by Qualys and has been classified as CVE-2015-0235. The researchers have nicknamed it Ghost as it can be triggered by GetHOST functions.
Ghost affects the GNU C Library (glibc), an implementation of the standard C library at the core of any Linux operating system.
Qualys explained in a blog post that the threat can be triggered locally or remotely, and is severe because an attacker could send a specially crafted email to a mail server to get a working remote shell to the compromised machine.
"Ghost poses a remote code execution risk that makes it incredibly easy for an attacker to exploit a machine," said Wolfgang Kandek, chief technology officer at Qualys.
"Given the sheer number of systems based on glibc, we believe this is a high severity vulnerability and should be addressed immediately."
Security features like ASLR, PIE and NX cannot stop the attack on 32-bit and 64-bit systems, the company warned.
The first vulnerable version of the GNU C Library is glibc-2.2, released in November 2000. Further updates to the library brought a number of mitigating factors, Qualys said, including an effective fix for the bug in May 2013 (between glibc-2.17 and glibc-2.18).
The fix wasn't classified as security-related, though, and long-term Linux distros such as Debian 7, Red Hat Enterprise Linux 6 and 7, CentOS 6 and 7, and Ubuntu 12.04 are still exposed to the bug.
The best solution, according to the researchers, is to install a patch from the Linux vendor. Qualys said that it has worked "closely" with the companies to deliver updates starting from 27 January. µ
But it keeps the juicy details firmly under wraps
And Sonny and Cher is on the radio
Gets its post-Windows 7 towel on the sun-lounger