oss-sec mailing list archives
Re: CVE request: Nagios (two issues)
From: Andreas Ericsson <ae () op5 se>
Date: Tue, 11 Nov 2008 11:36:00 +0100
Marc Shoenefeld represents the RedHat SRT in this, so added to Cc. Steven M. Christey wrote:
====================================================== Name: CVE-2008-5027 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5027 Reference: MLIST:[nagios-devel] 20081107 Security fixes completed Reference: URL:http://sourceforge.net/mailarchive/forum.php?thread_name=4914396D.5010009%40op5.se&forum_name=nagios-devel Reference: MLIST:[oss-security] 20081106 CVE request: Nagios (two issues) Reference: URL:http://www.openwall.com/lists/oss-security/2008/11/06/2 Reference: MISC:http://www.nagios.org/development/history/nagios-3x.php Reference: CONFIRM:http://www.op5.com/support/news/389-important-security-fix-available-for-op5-monitor Reference: BID:32156 Reference: URL:http://www.securityfocus.com/bid/32156 The Nagios process in (1) Nagios before 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote authenticated users to bypass authorization checks, and trigger execution of arbitrary programs by this process, via an (a) custom form or a (b) browser addon. ====================================================== Name: CVE-2008-5028 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5028 Reference: MLIST:[nagios-devel] 20081107 Security fixes completed Reference: URL:http://sourceforge.net/mailarchive/forum.php?thread_name=4914396D.5010009%40op5.se&forum_name=nagios-devel Reference: MLIST:[oss-security] 20081106 CVE request: Nagios (two issues) Reference: URL:http://www.openwall.com/lists/oss-security/2008/11/06/2 Reference: CONFIRM:http://git.op5.org/git/?p=nagios.git;a=commit;h=814d8d4d1a73f7151eeed187c0667585d79fea18 Reference: CONFIRM:http://www.op5.com/support/news/389-important-security-fix-available-for-op5-monitor Reference: SECUNIA:32610 Reference: URL:http://secunia.com/advisories/32610 Reference: XF:nagios-cmd-csrf(46426) Reference: URL:http://xforce.iss.net/xforce/xfdb/46426 Cross-site request forgery (CSRF) vulnerability in cmd.cgi in (1) Nagios 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote attackers to send commands to the Nagios process, and trigger execution of arbitrary programs by this process, via unspecified HTTP requests.
Actually, the CSRF issue is still in Nagios 3.0.5, but can no longer trigger execution of arbitrary programs by the Nagios process. Its impact is thereby reduced to disabling monitoring of the network and similar actions that can validly be requested from the Nagios process through the GUI. The problem is not present in op5 Monitor 4.0.1. A tar-ball containing the fix is available at http://www.op5.org/src/nagios-3.0.5p1.tar.gz. Thanks. -- Andreas Ericsson andreas.ericsson () op5 se OP5 AB www.op5.se Tel: +46 8-230225 Fax: +46 8-230231
Current thread:
- CVE request: Nagios (two issues) Andreas Ericsson (Nov 06)
- Re: CVE request: Nagios (two issues) Steven M. Christey (Nov 10)
- Re: CVE request: Nagios (two issues) Andreas Ericsson (Nov 11)
- Re: CVE request: Nagios (two issues) Steven M. Christey (Nov 12)
- Re: CVE request: Nagios (two issues) Andreas Ericsson (Nov 13)
- Re: CVE request: Nagios (two issues) Andreas Ericsson (Nov 11)
- Re: CVE request: Nagios (two issues) Steven M. Christey (Nov 10)