oss-security - Re: CVE request: Nagios (two issues)

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Tue, 11 Nov 2008 11:36:00 +0100
From: Andreas Ericsson <ae@....se>
To: "Steven M. Christey" <coley@...us.mitre.org>
CC: oss-security@...ts.openwall.com, Johannes Dagemark <jd@....se>, 
 Ethan Galstad <egalstad@...ios.org>,
 Marc Schoenefeld <mschoene@...hat.com>
Subject: Re: CVE request: Nagios (two issues)

Marc Shoenefeld represents the RedHat SRT in this, so added to Cc.

Steven M. Christey wrote:
> 
> 
> ======================================================
> Name: CVE-2008-5027
> Status: Candidate
> URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5027
> Reference: MLIST:[nagios-devel] 20081107 Security fixes completed
> Reference: URL:http://sourceforge.net/mailarchive/forum.php?thread_name=4914396D.5010009%40op5.se&forum_name=nagios-devel
> Reference: MLIST:[oss-security] 20081106 CVE request: Nagios (two issues)
> Reference: URL:http://www.openwall.com/lists/oss-security/2008/11/06/2
> Reference: MISC:http://www.nagios.org/development/history/nagios-3x.php
> Reference: CONFIRM:http://www.op5.com/support/news/389-important-security-fix-available-for-op5-monitor
> Reference: BID:32156
> Reference: URL:http://www.securityfocus.com/bid/32156
> 
> The Nagios process in (1) Nagios before 3.0.5 and (2) op5 Monitor
> before 4.0.1 allows remote authenticated users to bypass authorization
> checks, and trigger execution of arbitrary programs by this process,
> via an (a) custom form or a (b) browser addon.
> 
> 
> ======================================================
> Name: CVE-2008-5028
> Status: Candidate
> URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5028
> Reference: MLIST:[nagios-devel] 20081107 Security fixes completed
> Reference: URL:http://sourceforge.net/mailarchive/forum.php?thread_name=4914396D.5010009%40op5.se&forum_name=nagios-devel
> Reference: MLIST:[oss-security] 20081106 CVE request: Nagios (two issues)
> Reference: URL:http://www.openwall.com/lists/oss-security/2008/11/06/2
> Reference: CONFIRM:http://git.op5.org/git/?p=nagios.git;a=commit;h=814d8d4d1a73f7151eeed187c0667585d79fea18
> Reference: CONFIRM:http://www.op5.com/support/news/389-important-security-fix-available-for-op5-monitor
> Reference: SECUNIA:32610
> Reference: URL:http://secunia.com/advisories/32610
> Reference: XF:nagios-cmd-csrf(46426)
> Reference: URL:http://xforce.iss.net/xforce/xfdb/46426
> 
> Cross-site request forgery (CSRF) vulnerability in cmd.cgi in (1)
> Nagios 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote attackers
> to send commands to the Nagios process, and trigger execution of
> arbitrary programs by this process, via unspecified HTTP requests.
> 
> 

Actually, the CSRF issue is still in Nagios 3.0.5, but can no longer
trigger execution of arbitrary programs by the Nagios process. Its
impact is thereby reduced to disabling monitoring of the network and
similar actions that can validly be requested from the Nagios process
through the GUI.

The problem is not present in op5 Monitor 4.0.1. A tar-ball containing
the fix is available at http://www.op5.org/src/nagios-3.0.5p1.tar.gz.

Thanks.

-- 
Andreas Ericsson                   andreas.ericsson@....se
OP5 AB                             www.op5.se
Tel: +46 8-230225                  Fax: +46 8-230231

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.