Alerts This Week
Warning Icon 1 923
Alerts This Week
Warning Icon 1 923

Red Hat OpenStack: RHSA-2013:1526-01 Moderate: Local Attack in Nagios

red hat
Calendar Grey November 18, 2013
Dist Redhat Esm H88
Red Hat has released a notification regarding the updated Nagios software packages, addressing significant security vulnerabilities impacting OpenStack version 3.0.
Updated nagios packages that fix two security issues are now available for Red Hat OpenStack 3.0

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Summary

Nagios is a program that can monitor hosts and services on your network. It can send email or page alerts when problems arise and when problems are resolved.
Multiple insecure temporary file creation flaws were found in Nagios. A local attacker could use these flaws to cause arbitrary files to be overwritten as the root user via a symbolic link attack. (CVE-2013-2029, CVE-2013-4214)
These issues were discovered by Grant Murphy of the Red Hat Product Security Team.
All users of Nagios are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Topics%20covered

Topics Covered

security advisory security update local issue temporary file moderate severity Nagios Red Hat OpenStack

References

https://access.redhat.com/security/cve/CVE-2013-2029 https://access.redhat.com/security/cve/CVE-2013-4214 https://access.redhat.com/security/updates/classification/#moderate

Package List

OpenStack 3:
Source:
x86_64: nagios-3.5.1-2.el6ost.x86_64.rpm nagios-common-3.5.1-2.el6ost.x86_64.rpm nagios-debuginfo-3.5.1-2.el6ost.x86_64.rpm nagios-devel-3.5.1-2.el6ost.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package


Advisory ID: RHSA-2013:1526-01
Product: Red Hat OpenStack
Advisory URL: https://access.redhat.com/errata/RHSA-2013:1526.html
Issue date: 2013-11-18

Topic

Updated nagios packages that fix two security issues are now availablefor Red Hat OpenStack 3.0.The Red Hat Security Response Team has rated this update as having moderatesecurity impact. Common Vulnerability Scoring System (CVSS) base scores,which give detailed severity ratings, are available for each vulnerabilityfrom the CVE links in the References section.

Topics%20covered

Topics Covered

security advisory security update local issue temporary file moderate severity Nagios Red Hat OpenStack

Relevant Releases Architectures

OpenStack 3 - x86_64

Bugs Fixed

958002 - CVE-2013-4214 Nagios core: html/rss-newsfeed.php insecure temporary file usage

958015 - CVE-2013-2029 Nagios core: Insecure temporary file usage in nagios.upgrade_to_v3.sh

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here