oss-sec mailing list archives
Re: CVE Request (nagios)
From: Eygene Ryabinkin <rea-sec () codelabs ru>
Date: Mon, 8 Dec 2008 14:43:04 +0300
Andreas, good day. Mon, Dec 08, 2008 at 10:37:41AM +0100, Andreas Ericsson wrote:
I'm not seeing a CVE id for this. It seems the Nagios 3.0.6 release fixes a flaw: http://www.nagios.org/development/history/nagios-3x.php http://bugs.gentoo.org/show_bug.cgi?id=249876 Here is the patch: http://sourceforge.net/mailarchive/forum.php?thread_name=E1L6mat-0001sb-RN%40fdv4jf1.ch3.sourceforge.com&forum_name=nagios-checkinsCVE id 2008-5028 has been assigned to this.
No, CVE-2008-5028 is a different beast -- it is about cmd.cgi's command injection via newlines. Let me cite the commit Josh is referring to: http://nagios.cvs.sourceforge.net/viewvc/nagios/nagios/cgi/cmd.c?r1=1.45&r2=1.46&view=patch ----- @@ -2015,7 +2016,7 @@ break; case CMD_ADD_SVC_COMMENT: - result = cmd_submitf(cmd,"%s;%s;%d;%s;%s",current_time,host_name,service_desc,persistent_comment,comment_author,comment_data); + result = cmd_submitf(cmd,"%s;%s;%d;%s;%s",host_name,service_desc,persistent_comment,comment_author,comment_data); break; case CMD_DEL_HOST_COMMENT: @@ -2249,7 +2250,7 @@ } /* write the command to file */ - fputs(cmd,fp); + fprintf(fp, "%s\n", cmd); ----- As you see, the wrong arguments were passed to the cmd_submitf for the service comments -- argument 'service_desc' will be treated as integer and argument 'presistent_comment' (that is essentially a boolean that is simulated via 'int' type) will be treated as the pointer to a string. SEGV is likely here. And another issue is that newline seem to be missing from the resulting command line that was written to the cmd file. Can't comment on this now, but I assume that a very long line instead of many shorter (and proper) ones will be in the cmd file before this fix. By the way, I think that it is wrong to cite http://sourceforge.net/mailarchive/forum.php?thread_name=4914396D.5010009%40op5.se&forum_name=nagios-devel at the CVE-2008-5027 -- it seem to talk about the issues after 3.0.5 and command injection via cmd.cgi was already fixed, although it introduced some regressions. -- Eygene
Current thread:
- CVE Request (nagios) Josh Bressers (Dec 05)
- Re: CVE Request (nagios) Andreas Ericsson (Dec 08)
- Re: CVE Request (nagios) Eygene Ryabinkin (Dec 08)
- Re: CVE Request (nagios) Andreas Ericsson (Dec 08)
- Re: CVE Request (nagios) Eygene Ryabinkin (Dec 08)
- Re: CVE Request (nagios) Jan Lieskovsky (Dec 08)
- Re: CVE Request (nagios) Eygene Ryabinkin (Dec 08)
- Re: CVE Request (nagios) Eygene Ryabinkin (Dec 08)
- Re: CVE Request (nagios) Eygene Ryabinkin (Dec 10)
- Re: CVE Request (nagios) Andreas Ericsson (Dec 10)
- Re: CVE Request (nagios) Eygene Ryabinkin (Dec 10)
- Re: CVE Request (nagios) Andreas Ericsson (Dec 10)
- Re: CVE Request (nagios) Jan Lieskovsky (Dec 11)
- Re: CVE Request (nagios) Eygene Ryabinkin (Dec 08)
- Re: CVE Request (nagios) Andreas Ericsson (Dec 08)