“We also have good reasons to believe PHP applications might also be affected, through its gethostbyname() function wrapper. An example of where this could be a big issue is within WordPress itself: it uses a function named wp_http_validate_url() to validate every pingback’s post URL:” states the Sucuri researcher Marc-Alexandre Montpas

GHOST vulnerability represents a serious threat for WordPress CMS that invoke gethostbyname() function wrapper when uses the function wp_http_validate_url () to validate pingbacks.

“So an attacker could leverage this vector to insert a malicious URL that would trigger a buffer overflow bug, server-side, potentially allowing him to gain privileges on the server.” continues the post.

The vulnerability affects all versions of glibc from glibc-2.17 and lower. However, it was patched in glibc-2.18 in May 2013, but was not marked as a security vulnerability so the fix did not make it into many common Linux distributions like RedHat and Ubuntu.

Sucuri invites all administrators of dedicated servers and virtual private servers running Linux OS to update the flawed library.

“If you have a dedicated server (or VPS) running Linux, you have to make sure you update it right away.” Montpas said.

Administrators can run the following code on their systems to discover if they are affected by the GHOST vulnerability:

php -r '$e="0″;for($i=0;$i<2500;$i++){$e="0$e";} gethostbyname($e);' Segmentation fault

If the system is vulnerable, administrators have to update their servers with software updates provided by Linux distributions.

The experts also recommend disabling the XML-RPC process and Pingback Requests to reduce the surface of attack.

add_filter( 'xmlrpc_methods' , function( $methods' ) { unset( $methods[ 'pingback.ping ] ); return $methods; } );