Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 8 Dec 2008 14:43:04 +0300
From: Eygene Ryabinkin <>
Subject: Re: CVE Request (nagios)

Andreas, good day.

Mon, Dec 08, 2008 at 10:37:41AM +0100, Andreas Ericsson wrote:
> > I'm not seeing a CVE id for this.  It seems the Nagios 3.0.6 release fixes a flaw:
> >
> >
> > 
> > Here is the patch:
> >
> > 
> CVE id 2008-5028 has been assigned to this.

No, CVE-2008-5028 is a different beast -- it is about cmd.cgi's command
injection via newlines.  Let me cite the commit Josh is referring to:
@@ -2015,7 +2016,7 @@
-		result = cmd_submitf(cmd,"%s;%s;%d;%s;%s",current_time,host_name,service_desc,persistent_comment,comment_author,comment_data);
+		result = cmd_submitf(cmd,"%s;%s;%d;%s;%s",host_name,service_desc,persistent_comment,comment_author,comment_data);
@@ -2249,7 +2250,7 @@
 	/* write the command to file */
-	fputs(cmd,fp);
+	fprintf(fp, "%s\n", cmd);
As you see, the wrong arguments were passed to the cmd_submitf for the
service comments -- argument 'service_desc' will be treated as integer
and argument 'presistent_comment' (that is essentially a boolean that is
simulated via 'int' type) will be treated as the pointer to a string.
SEGV is likely here.

And another issue is that newline seem to be missing from the resulting
command line that was written to the cmd file.  Can't comment on this
now, but I assume that a very long line instead of many shorter (and
proper) ones will be in the cmd file before this fix.

By the way, I think that it is wrong to cite
at the CVE-2008-5027 -- it seem to talk about the issues after 3.0.5
and command injection via cmd.cgi was already fixed, although it
introduced some regressions.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.