Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 11.04 USN-1151-1 Critical: Nagios3 XSS Risk Advisory

ubuntu
Calendar Grey June 15, 2011
Scroller Ubuntu
Ubuntu Security Notice USN-2042-2 deals with vulnerabilities in apache2 that could enable unauthorized access via manipulated requests.
An attacker could modify or steal data if you were tricked into clicking on a special link to Nagios.

Summary

An attacker could modify or steal data if you were tricked into clicking on

a special link to Nagios.

Software Description:

- nagios3: A host/service/network monitoring and management system

Details:

Stefan Schurtz discovered than Nagios did not properly sanitize its input

when processing certain requests, resulting in cross-site scripting (XSS)

vulnerabilities. With cross-site scripting vulnerabilities, if a user were

tricked into viewing server output during a crafted server request, a

remote attacker could exploit this to modify the contents, or steal

confidential data, within the same domain.

Topics%20covered

Topics Covered

security advisory critical xss ubuntu nagios3

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  nagios3-cgi                     3.2.3-1ubuntu1.2

Ubuntu 10.10:
  nagios3-cgi                     3.2.1-2ubuntu1.2

Ubuntu 10.04 LTS:
  nagios3-cgi                     3.2.0-4ubuntu2.2

After a standard system update you need to restart Nagios to make
all the necessary changes.

References

CVE-2011-1523, CVE-2011-2179

Severity
critical
Lowest
Low
Medium
High
Critical

June 15, 2011

Topics%20covered

Topics Covered

security advisory critical xss ubuntu nagios3

Package Information

https://launchpad.net/ubuntu/+source/nagios3/3.2.3-1ubuntu1.2
https://launchpad.net/ubuntu/+source/nagios3/3.2.1-2ubuntu1.2
https://launchpad.net/ubuntu/+source/nagios3/3.2.0-4ubuntu2.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.