Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 521
Alerts This Week
Warning Icon 1 521

Fedora 25: 2017-3776c9d747 Moderate: Munin Local File Write Threat

fedora
Calendar Grey March 10, 2017
Scroller Fedora
Critical news for munin resolves a file overwrite bug triggered by improper argument expansion in CGI.
CVE-2017-6188: Upstream PR 797: Fix wrong parameter expansion in CGI

Summary

Munin is a highly flexible and powerful solution used to create graphs

of virtually everything imaginable throughout your network, while still

maintaining a rattling ease of installation and configuration.

This package contains the grapher/gatherer. You will only need one instance of

it in your network. It will periodically poll all the nodes in your network

it's aware of for data, which it in turn will use to create graphs and HTML

pages, suitable for viewing with your graphical web browser of choice.

Munin is written in Perl, and relies heavily on Tobi Oetiker's excellent

RRDtool.

Creaete a munin web user after installing:

htpasswd -bc /etc/munin/munin-htpasswd MUNIN_WEB_USER PASSWORD

Update Information:

CVE-2017-6188: Upstream PR 797: Fix wrong parameter expansion in CGI

Topics%20covered

Topics Covered

security advisory Fedora network monitoring update information munin local file write CGI threat

Change Log

References


[ 1 ] Bug #1425855 - CVE-2017-6188 munin: Local file write vulnerability with CGI graphs enabled https://bugzilla.redhat.com/show_bug.cgi?id=1425855

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade munin' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html

Severity
important
Lowest
Low
Medium
High
Critical

Name: munin
Product: Fedora 25
Version: 2.0.30
Release: 5.fc25
URL: http://munin-monitoring.org/
Summary: Network-wide graphing framework (grapher/gatherer)

Topics%20covered

Topics Covered

security advisory Fedora network monitoring update information munin local file write CGI threat

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.