Re: CVE Request (nagios)

[Eygene Ryabinkin <rea-sec () codelabs ru>]

Andreas, good day.

Will you be able to clarify two things.

Mon, Dec 08, 2008 at 05:19:52PM +0300, Eygene Ryabinkin wrote:
> So
>   http://nagios.cvs.sourceforge.net/viewvc/nagios/nagios/base/commands.c?r1=1.109&r2=1.110&view=patch
> just completely closes the processing of these commands from the
> Nagios side.  May be this was the fix for the case when the evil
> contents from the command file were still floating around but the
> upgraded Nagios won't process them because they could go from the
> previous successful attack but are lying unprocessed?

Do you think it is really so?

> > It is a bit strange that it was done after 3.0.5 (CSRF was documented in
> > 3.0.5 release notes), but...  By the way, entry for CVE-2008-5028 speaks
> > about 3.0.5 as about the vulnerable to the CSRF and it is inconsistent
> > with the release notes at
> >   http://www.nagios.org/development/history/nagios-3x.php.
>
> So I feel the the CSRF was "somehow closed" in 3.0.5 and CVE entry may
> need fixing.  The remains from this bug that could migrate from 3.0.5 to
> 3.0.6 (but not in the functional sense, only via the unprocessed command
> file) were "fixed" in 3.0.6.

CVE-2008-5028 really speaks about 3.0.5 as about vulnerable to CSRF.  At
least CHANGE_ commands were closed in 3.0.5 and were (presumably)
additionally closed at the Nagios server side in 3.0.6.  So either 3.0.6
is vulnerable too, 3.0.5 is not vulnerable to CSRF or I am missing
something.  What to choose?

Thanks!
-- 
Eygene