Date: Mon, 8 Dec 2008 14:43:04 +0300 From: Eygene Ryabinkin <rea-sec@...elabs.ru> To: oss-security@...ts.openwall.com Cc: coley@...re.org Subject: Re: CVE Request (nagios) Andreas, good day. Mon, Dec 08, 2008 at 10:37:41AM +0100, Andreas Ericsson wrote: > > I'm not seeing a CVE id for this. It seems the Nagios 3.0.6 release fixes a flaw: > > http://www.nagios.org/development/history/nagios-3x.php > > http://bugs.gentoo.org/show_bug.cgi?id=249876 > > > > Here is the patch: > > http://sourceforge.net/mailarchive/forum.php?thread_name=E1L6mat-0001sb-RN%40fdv4jf1.ch3.sourceforge.com&forum_name=nagios-checkins > > > > CVE id 2008-5028 has been assigned to this. No, CVE-2008-5028 is a different beast -- it is about cmd.cgi's command injection via newlines. Let me cite the commit Josh is referring to: http://nagios.cvs.sourceforge.net/viewvc/nagios/nagios/cgi/cmd.c?r1=1.45&r2=1.46&view=patch ----- @@ -2015,7 +2016,7 @@ break; case CMD_ADD_SVC_COMMENT: - result = cmd_submitf(cmd,"%s;%s;%d;%s;%s",current_time,host_name,service_desc,persistent_comment,comment_author,comment_data); + result = cmd_submitf(cmd,"%s;%s;%d;%s;%s",host_name,service_desc,persistent_comment,comment_author,comment_data); break; case CMD_DEL_HOST_COMMENT: @@ -2249,7 +2250,7 @@ } /* write the command to file */ - fputs(cmd,fp); + fprintf(fp, "%s\n", cmd); ----- As you see, the wrong arguments were passed to the cmd_submitf for the service comments -- argument 'service_desc' will be treated as integer and argument 'presistent_comment' (that is essentially a boolean that is simulated via 'int' type) will be treated as the pointer to a string. SEGV is likely here. And another issue is that newline seem to be missing from the resulting command line that was written to the cmd file. Can't comment on this now, but I assume that a very long line instead of many shorter (and proper) ones will be in the cmd file before this fix. By the way, I think that it is wrong to cite http://sourceforge.net/mailarchive/forum.php?thread_name=4914396D.5010009%40op5.se&forum_name=nagios-devel at the CVE-2008-5027 -- it seem to talk about the issues after 3.0.5 and command injection via cmd.cgi was already fixed, although it introduced some regressions. -- Eygene
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.