oss-sec mailing list archives
CVE request: Nagios (two issues)
From: Andreas Ericsson <ae () op5 se>
Date: Thu, 06 Nov 2008 17:34:06 +0100
We need two CVE id's for the Nagios project. ****** 1. Low-privileged users can create a custom form (or use a browser addon) to bypass authorization and submit commands to the nagios process that causes other programs to be run with the privileges of the Nagios process. Fixed in Nagios 3.0.5. ****** 2. Cross-Site Request Forgery allows remote attackers to submit commands to the nagios process, thereby causing programs to run on the Nagios server with the privileges of the Nagios process. Patch available at http://git.op5.org/git/?p=nagios.git;a=commit;h=814d8d4d1a73f7151eeed187c0667585d79fea18 ****** TIA. -- Andreas Ericsson andreas.ericsson () op5 se OP5 AB www.op5.se Tel: +46 8-230225 Fax: +46 8-230231
Current thread:
- CVE request: Nagios (two issues) Andreas Ericsson (Nov 06)
- Re: CVE request: Nagios (two issues) Steven M. Christey (Nov 10)
- Re: CVE request: Nagios (two issues) Andreas Ericsson (Nov 11)
- Re: CVE request: Nagios (two issues) Steven M. Christey (Nov 12)
- Re: CVE request: Nagios (two issues) Andreas Ericsson (Nov 13)
- Re: CVE request: Nagios (two issues) Andreas Ericsson (Nov 11)
- Re: CVE request: Nagios (two issues) Steven M. Christey (Nov 10)