Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 08 Dec 2008 13:00:18 +0100
From: Andreas Ericsson <>
Subject: Re: CVE Request (nagios)

Eygene Ryabinkin wrote:
> Andreas, good day.
> Mon, Dec 08, 2008 at 10:37:41AM +0100, Andreas Ericsson wrote:
>>> I'm not seeing a CVE id for this.  It seems the Nagios 3.0.6 release fixes a flaw:
>>> Here is the patch:
>> CVE id 2008-5028 has been assigned to this.
> No, CVE-2008-5028 is a different beast -- it is about cmd.cgi's command
> injection via newlines.  Let me cite the commit Josh is referring to:
> -----
> @@ -2015,7 +2016,7 @@
>  		break;
> -		result = cmd_submitf(cmd,"%s;%s;%d;%s;%s",current_time,host_name,service_desc,persistent_comment,comment_author,comment_data);
> +		result = cmd_submitf(cmd,"%s;%s;%d;%s;%s",host_name,service_desc,persistent_comment,comment_author,comment_data);
>  		break;
> @@ -2249,7 +2250,7 @@
>  	        }
>  	/* write the command to file */
> -	fputs(cmd,fp);
> +	fprintf(fp, "%s\n", cmd);
> -----
> As you see, the wrong arguments were passed to the cmd_submitf for the
> service comments -- argument 'service_desc' will be treated as integer
> and argument 'presistent_comment' (that is essentially a boolean that is
> simulated via 'int' type) will be treated as the pointer to a string.
> SEGV is likely here.

Ah, right. Yes, that's true. however, it's not a vulnerability as it's
doing read-only access, and it can't cause DoS as it's only the CGI
that's affected.

> And another issue is that newline seem to be missing from the resulting
> command line that was written to the cmd file.  Can't comment on this
> now, but I assume that a very long line instead of many shorter (and
> proper) ones will be in the cmd file before this fix.

Yes, that's true. Most people didn't notice due to the fact that Nagios
reads the command-pipe input when it finds anything there instead of
waiting for a newline to appear in it. It was reported that user-commands
that cause more than one command to be written to the pipe were broken,
so it's not a huge issue.

In short; I see no vulnerability here, and thus no need for a CVE.

Andreas Ericsson         
OP5 AB                   
Tel: +46 8-230225                  Fax: +46 8-230231

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.