Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -2 articles for you...
91
security advisoryhigh severitygentooGentoo: GLSA-202007-31 High Severity: Icinga Root Privilege Escalation
Icinga installs files with insecure permissions allowing root privilege escalation.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202007-31 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Icinga: Root privilege escalation Date: July 27, 2020 Bugs: #638186 ID: 202007-31 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Icinga installs files with insecure permissions allowing root privilege escalation. Background ========= Icinga is an open source computer system and network monitoring application. It was originally created as a fork of the Nagios system monitoring application in 2009. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-analyzer/icinga < 1.14.2 Vulnerable! ------------------------------------------------------------------- NOTE: Certain packages are still vulnerable. Users should migrate to another package if one is available or wait for the existing packages to be marked stable by their architecture maintainers. Description ========== It was discovered that Icinga's installed files have insecure permissions, possibly allowing root privilege escalation. Impact ===== A local attacker could escalate privileges to root. Workaround ========= There is no known workaround at this time. Resolution ========= Gentoo has discontinued support for Icinga. We recommend that usersunmerge Icinga: # emerge --unmerge "net-analyzer/icinga" NOTE: The Gentoo developer(s) maintaining Icinga havediscontinued support at this time. It may be possible that a new Gentoo developer will update Icinga at a later date. The natural replacement is Icinga 2 (net-analyzer/icinga2). References ========= [ 1 ] CVE-2017-16882 https://nvd.nist.gov/vuln/detail/CVE-2017-16882 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202007-31 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Jul 26, 2020
Gentoo
100
security advisorymoderateXSSSUSE: 2018:3620-1 Moderate: Icinga Symlink And XSS Issues
An update that fixes three vulnerabilities is now available. . SUSE Security Update: Security update for icinga ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:3620-1 Rating: moderate References: #1011630 #1018047 #952777 Cross-References: CVE-2015-8010 CVE-2016-10089 CVE-2016-8641 Affected Products: SUSE Manager Tools 12 SUSE Enterprise Storage 4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for icinga fixes the following issues: Security issues fixed: - CVE-2015-8010: Fixed XSS in the icinga classic UI (boo#952777) - CVE-2016-8641 / CVE-2016-10089: fixed a possible symlink attack for files/dirs created by root (boo#1011630 and boo#1018047) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Manager Tools 12: zypper in -t patch SUSE-SLE-Manager-Tools-12-2018-2580=1 - SUSE Enterprise Storage 4: zypper in -t patch SUSE-Storage-4-2018-2580=1 Package List: - SUSE Manager Tools 12 (aarch64 ppc64le s390x x86_64): icinga-1.13.3-12.3.1 icinga-debuginfo-1.13.3-12.3.1 icinga-debugsource-1.13.3-12.3.1 icinga-devel-1.13.3-12.3.1 icinga-doc-1.13.3-12.3.1 icinga-idoutils-1.13.3-12.3.1 icinga-idoutils-mysql-1.13.3-12.3.1 icinga-idoutils-oracle-1.13.3-12.3.1 icinga-idoutils-pgsql-1.13.3-12.3.1 icinga-plugins-downtimes-1.13.3-12.3.1 icinga-plugins-eventhandlers-1.13.3-12.3.1 icinga-www-1.13.3-12.3.1 icinga-www-config-1.13.3-12.3.1 monitoring-tools-1.13.3-12.3.1 - SUSE Enterprise Storage 4 (aarch64 x86_64): icinga-1.13.3-12.3.1 icinga-debuginfo-1.13.3-12.3.1 icinga-debugsource-1.13.3-12.3.1 References: https://www.suse.com/security/cve/CVE-2015-8010.html https://www.suse.com/security/cve/CVE-2016-10089.html https://www.suse.com/security/cve/CVE-2016-8641.html https://bugzilla.suse.com/1011630 https://bugzilla.suse.com/1018047 https://bugzilla.suse.com/952777 _______________________________________________ sle-security-updates mailing list
Nov 05, 2018
SuSE
202
security advisorymoderateXSSopenSUSE Leap 42.3 openSUSE-SU-2018:3258-1 moderate: icinga security update
An update that fixes four vulnerabilities is now available.. openSUSE Security Update: Security update for icinga ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3258-1 Rating: moderate References: #1011630 #1018047 #952777 #961115 Cross-References: CVE-2015-8010 CVE-2016-0726 CVE-2016-10089 CVE-2016-8641 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for icinga fixes the following issues: Update to 1.14.0 - CVE-2015-8010: Fixed XSS in the icinga classic UI (boo#952777) - CVE-2016-8641 / CVE-2016-10089: fixed a possible symlink attack for files/dirs created by root (boo#1011630 and boo#1018047) - CVE-2016-0726: removed the pre-configured administrative account with fixed password for the WebUI - (boo#961115) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1206=1 Package List: - openSUSE Leap 42.3 (x86_64): icinga-1.14.0-8.3.2 icinga-debuginfo-1.14.0-8.3.2 icinga-debugsource-1.14.0-8.3.2 icinga-devel-1.14.0-8.3.2 icinga-doc-1.14.0-8.3.2 icinga-idoutils-1.14.0-8.3.2 icinga-idoutils-debuginfo-1.14.0-8.3.2 icinga-idoutils-mysql-1.14.0-8.3.2 icinga-idoutils-oracle-1.14.0-8.3.2 icinga-idoutils-pgsql-1.14.0-8.3.2 icinga-plugins-downtimes-1.14.0-8.3.2 icinga-plugins-eventhandlers-1.14.0-8.3.2 icinga-www-1.14.0-8.3.2 icinga-www-config-1.14.0-8.3.2 icinga-www-debuginfo-1.14.0-8.3.2 monitoring-tools-1.14.0-8.3.2 monitoring-tools-debuginfo-1.14.0-8.3.2 References: https://www.suse.com/security/cve/CVE-2015-8010.html https://www.suse.com/security/cve/CVE-2016-0726.html https://www.suse.com/security/cve/CVE-2016-10089.html https://www.suse.com/security/cve/CVE-2016-8641.html https://bugzilla.suse.com/1011630 https://bugzilla.suse.com/1018047 https://bugzilla.suse.com/952777 https://bugzilla.suse.com/961115 -- . A fresh update has been released for icinga on openSUSE Leap 42.3, resolving various concerns and improving protection protocols.. openSUSE Update,Icinga Security Patch,Software Fixes. . LinuxSecurity.com Team
Oct 19, 2018
OpenSUSE
202
security advisoryprivilege escalationcross site scriptingopenSUSE: 2017:0146-1 Important: Icinga XSS And Privilege Escalation
An update that fixes two vulnerabilities is now available. An update that fixes two vulnerabilities is now available. An update that fixes two vulnerabilities is now available.. openSUSE Security Update: Security update for icinga ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0146-1 Rating: important References: #1014637 #952777 Cross-References: CVE-2015-8010 CVE-2016-9566 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for icinga includes various upstream fixes and the following security security fixes: - icinga was updated to version 1.14.0 - the classic-UI was vulnerable to a cross site scripting attack (CVE-2015-8010, boo#952777) - A user with nagios privileges could have gained root privileges by placing a symbolic link at the logfile location (CVE-2016-9566, boo#1014637) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-100=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-100=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): icinga-1.14.0-4.1 icinga-debuginfo-1.14.0-4.1 icinga-debugsource-1.14.0-4.1 icinga-devel-1.14.0-4.1 icinga-doc-1.14.0-4.1 icinga-idoutils-1.14.0-4.1 icinga-idoutils-debuginfo-1.14.0-4.1 icinga-idoutils-mysql-1.14.0-4.1 icinga-idoutils-oracle-1.14.0-4.1 icinga-idoutils-pgsql-1.14.0-4.1 icinga-plugins-downtimes-1.14.0-4.1 icinga-plugins-eventhandlers-1.14.0-4.1 icinga-www-1.14.0-4.1 icinga-www-config-1.14.0-4.1 icinga-www-debuginfo-1.14.0-4.1 monitoring-tools-1.14.0-4.1 monitoring-tools-debuginfo-1.14.0-4.1 - openSUSE Leap 42.1 (i586 x86_64): icinga-1.14.0-3.1 icinga-debuginfo-1.14.0-3.1 icinga-debugsource-1.14.0-3.1 icinga-devel-1.14.0-3.1 icinga-doc-1.14.0-3.1 icinga-idoutils-1.14.0-3.1 icinga-idoutils-debuginfo-1.14.0-3.1 icinga-idoutils-mysql-1.14.0-3.1 icinga-idoutils-oracle-1.14.0-3.1 icinga-idoutils-pgsql-1.14.0-3.1 icinga-plugins-downtimes-1.14.0-3.1 icinga-plugins-eventhandlers-1.14.0-3.1 icinga-www-1.14.0-3.1 icinga-www-config-1.14.0-3.1 icinga-www-debuginfo-1.14.0-3.1 monitoring-tools-1.14.0-3.1 monitoring-tools-debuginfo-1.14.0-3.1 References: https://www.suse.com/security/cve/CVE-2015-8010.html https://www.suse.com/security/cve/CVE-2016-9566.html https://bugzilla.suse.com/1014637 https://bugzilla.suse.com/952777 . An essential update for openSUSE icinga addresses vulnerabilities in cross site scripting and privilege escalation, enhancing security for more reliable operation.. openSUSE Security, icinga update, privilege escalation, Cross Site Scripting, security patches. . Severity: Important. LinuxSecurity.com Team
Jan 16, 2017
•Important
OpenSUSE
91
security advisorygentooprivilege escalationGentoo: GLSA-201612-51 Normal: Icinga Privilege Escalation Threat
A vulnerability in Icinga could lead to privilege escalation.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201612-51 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Icinga: Privilege escalation Date: December 31, 2016 Bugs: #603534 ID: 201612-51 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A vulnerability in Icinga could lead to privilege escalation. Background ========= Icinga is an open source computer system and network monitoring application. It was originally created as a fork of the Nagios system monitoring application in 2009. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-analyzer/icinga < 1.13.4 > = 1.13.4 Description ========== Icinga daemon was found to perform unsafe operations when handling the log file. Impact ===== A local attacker, who either is already Icinga's system user or belongs to Icinga's group, could potentially escalate privileges. Workaround ========= There is no known workaround at this time. Resolution ========= All Icinga users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =net-analyzer/icinga-1.13.4" References ========= [ 1 ] CVE-2016-9566 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9566 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201612-51 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuringthe confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Dec 31, 2016
Gentoo
87
security advisorydenial of servicedebianDebian: DSA-2956-1 Critical Icinga Risks: Code Execution and DoS
Multiple security issues have been found in the Icinga host and network monitoring system (buffer overflows, cross-site request forgery, off-by ones) which could result in the execution of arbitrary code, denial of service or session hijacking. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2956-1
Jun 11, 2014
•Critical
Debian
87
security advisorybuffer overflowdebianDebian: DSA-2653-1 Critical: Icinga Buffer Overflow Remote Threat
It was discovered that Icinga, a host and network monitoring system, contains several buffer overflows in the history.cgi CGI program. For the stable distribution (squeeze), this problem has been fixed in . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2653-1
Mar 26, 2013
•Critical
Debian
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!