[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 8 Dec 2008 14:43:04 +0300
From: Eygene Ryabinkin <rea-sec@...elabs.ru>
To: oss-security@...ts.openwall.com
Cc: coley@...re.org
Subject: Re: CVE Request (nagios)
Andreas, good day.
Mon, Dec 08, 2008 at 10:37:41AM +0100, Andreas Ericsson wrote:
> > I'm not seeing a CVE id for this. It seems the Nagios 3.0.6 release fixes a flaw:
> > http://www.nagios.org/development/history/nagios-3x.php
> > http://bugs.gentoo.org/show_bug.cgi?id=249876
> >
> > Here is the patch:
> > http://sourceforge.net/mailarchive/forum.php?thread_name=E1L6mat-0001sb-RN%40fdv4jf1.ch3.sourceforge.com&forum_name=nagios-checkins
> >
>
> CVE id 2008-5028 has been assigned to this.
No, CVE-2008-5028 is a different beast -- it is about cmd.cgi's command
injection via newlines. Let me cite the commit Josh is referring to:
http://nagios.cvs.sourceforge.net/viewvc/nagios/nagios/cgi/cmd.c?r1=1.45&r2=1.46&view=patch
-----
@@ -2015,7 +2016,7 @@
break;
case CMD_ADD_SVC_COMMENT:
- result = cmd_submitf(cmd,"%s;%s;%d;%s;%s",current_time,host_name,service_desc,persistent_comment,comment_author,comment_data);
+ result = cmd_submitf(cmd,"%s;%s;%d;%s;%s",host_name,service_desc,persistent_comment,comment_author,comment_data);
break;
case CMD_DEL_HOST_COMMENT:
@@ -2249,7 +2250,7 @@
}
/* write the command to file */
- fputs(cmd,fp);
+ fprintf(fp, "%s\n", cmd);
-----
As you see, the wrong arguments were passed to the cmd_submitf for the
service comments -- argument 'service_desc' will be treated as integer
and argument 'presistent_comment' (that is essentially a boolean that is
simulated via 'int' type) will be treated as the pointer to a string.
SEGV is likely here.
And another issue is that newline seem to be missing from the resulting
command line that was written to the cmd file. Can't comment on this
now, but I assume that a very long line instead of many shorter (and
proper) ones will be in the cmd file before this fix.
By the way, I think that it is wrong to cite
http://sourceforge.net/mailarchive/forum.php?thread_name=4914396D.5010009%40op5.se&forum_name=nagios-devel
at the CVE-2008-5027 -- it seem to talk about the issues after 3.0.5
and command injection via cmd.cgi was already fixed, although it
introduced some regressions.
--
Eygene
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
