Ubuntu: Nagios vulnerability

    Date22 Dec 2008
    CategoryUbuntu
    2911
    Posted ByLinuxSecurity Advisories
    It was discovered that Nagios did not properly parse commands submitted using the web interface. An authenticated user could use a custom form or a browser addon to bypass security restrictions and submit unauthorized commands.
    ===========================================================
    Ubuntu Security Notice USN-698-1          December 22, 2008
    nagios vulnerability
    CVE-2008-5027
    ===========================================================
    
    A security issue affects the following Ubuntu releases:
    
    Ubuntu 6.06 LTS
    
    This advisory also applies to the corresponding versions of
    Kubuntu, Edubuntu, and Xubuntu.
    
    The problem can be corrected by upgrading your system to the
    following package versions:
    
    Ubuntu 6.06 LTS:
      nagios-common                   2:1.3-cvs.20050402-8ubuntu8
    
    After a standard system upgrade you need to restart Nagios to effect
    the necessary changes.
    
    Details follow:
    
    It was discovered that Nagios did not properly parse commands submitted using
    the web interface. An authenticated user could use a custom form or a browser
    addon to bypass security restrictions and submit unauthorized commands.
    
    
    Updated packages for Ubuntu 6.06 LTS:
    
      Source archives:
    
        http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios_1.3-cvs.20050402-8ubuntu8.diff.gz
          Size/MD5:    70914 96d8036bdb33aadd3141715039c91b24
        http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios_1.3-cvs.20050402-8ubuntu8.dsc
          Size/MD5:      959 0393336015bf452f5dfeb74d75245311
        http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios_1.3-cvs.20050402.orig.tar.gz
          Size/MD5:  1621251 0f92b7b8e705411b7881d3650cbb5d56
    
      Architecture independent packages:
    
        http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-common_1.3-cvs.20050402-8ubuntu8_all.deb
          Size/MD5:  1218132 d18e298ee16f4c6c6b7c5969c46044e6
    
      amd64 architecture (Athlon64, Opteron, EM64T Xeon):
    
        http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3-cvs.20050402-8ubuntu8_amd64.deb
          Size/MD5:  1030206 085483fdefd0d7bc43e55dbc5be2bcd6
        http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3-cvs.20050402-8ubuntu8_amd64.deb
          Size/MD5:  1041656 09fc7bb2ff11062603680d09e290909b
        http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-cvs.20050402-8ubuntu8_amd64.deb
          Size/MD5:  1025618 61619d13effd9a4970486abf5933c756
    
      i386 architecture (x86 compatible Intel/AMD):
    
        http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3-cvs.20050402-8ubuntu8_i386.deb
          Size/MD5:   877846 544afaebec24e7e94d2ce1da3a89346c
        http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3-cvs.20050402-8ubuntu8_i386.deb
          Size/MD5:   886544 411d3ca5a204aa41a4a42ef6e5f56453
        http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-cvs.20050402-8ubuntu8_i386.deb
          Size/MD5:   872936 aa31f6d1fb8a081a206eae3d6bfb3dd6
    
      powerpc architecture (Apple Macintosh G3/G4/G5):
    
        http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3-cvs.20050402-8ubuntu8_powerpc.deb
          Size/MD5:  1015630 540a27062c7f8612b7f460b2bcfd93b9
        http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3-cvs.20050402-8ubuntu8_powerpc.deb
          Size/MD5:  1024374 47e0480006df0b20a83f67b56da7a9f8
        http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-cvs.20050402-8ubuntu8_powerpc.deb
          Size/MD5:   993324 03a67a7675075050a672a4c515e8e0c3
    
      sparc architecture (Sun SPARC/UltraSPARC):
    
        http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3-cvs.20050402-8ubuntu8_sparc.deb
          Size/MD5:   918810 7340348f043dd884c88bd016ee30e41d
        http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3-cvs.20050402-8ubuntu8_sparc.deb
          Size/MD5:   926172 e9ccf388b828a17e868807aa39cb5b51
        http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-cvs.20050402-8ubuntu8_sparc.deb
          Size/MD5:   917374 c88dec0d93f590f8a93ebbc701696f68
    
    
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"23","type":"x","order":"1","pct":56.1,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":12.2,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"13","type":"x","order":"3","pct":31.71,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    Advisories

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.