Gentoo: GLSA-200711-11: Nagios Plugins: Two buffer overflows
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Gentoo Linux Security Advisory GLSA 200711-11 https://security.gentoo.org/
Severity: High Title: Nagios Plugins: Two buffer overflows Date: November 08, 2007 Bugs: #196308, #194178 ID: 200711-11
Synopsis ======= Two buffer overflow vulnerabilities in the Nagios Plugins might allow for remote execution of arbitrary code.
Background ========= The Nagios Plugins are an official set of plugins for Nagios, an open source host, service and network monitoring program.
Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-analyzer/nagios-plugins < 1.4.10-r1 >= 1.4.10-r1
========== fabiodds reported a boundary checking error in the "check_snmp" plugin when processing SNMP "GET" replies that could lead to a stack-based buffer overflow (CVE-2007-5623). Nobuhiro Ban reported a boundary checking error in the redir() function of the "check_http" plugin when processing HTTP "Location:" header information which might lead to a buffer overflow (CVE-2007-5198).
Impact ===== A remote attacker could exploit these vulnerabilities to execute arbitrary code with the privileges of the user running Nagios or cause a Denial of Service by (1) sending a specially crafted SNMP "GET" reply to the Nagios daemon or (2) sending an overly long string in the "Location:" header of an HTTP reply. Note that to exploit (2), the malicious or compromised web server has to be configured in Nagios and the "-f" (follow) option has to be enabled.
Workaround ========= There is no known workaround at this time.
Resolution ========= All users of the Nagios Plugins should upgrade to the latest version:
# emerge --sync # emerge -av --oneshot ">=net-analyzer/nagios-plugins-1.4.10-r1"
References ========= [ 1 ] CVE-2007-5198 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5198 [ 2 ] CVE-2007-5623 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5623
Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/200711-11
Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org/.
License ====== Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - iD8DBQFHM2DVuhJ+ozIKI5gRAn38AJ98L27Sde9S5ebhZYWNt+je89v1UACffi8l CeAHOSuc4Z2xQ9nFp6T8a20=IvZ2 -----END PGP SIGNATURE-----
Resolution
References
Availability
Concerns
![Dist Gentoo](/images/distros/dist-gentoo.png)