The Nagios process in (1) Nagios before 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote authenticated users to bypass authorization checks, and trigger execution of arbitrary programs by this process, via an (a) custom form or a (b) browser addon.

A CSRF bug in nagios' cmd.cgi (CVE-2008-5028) has been fixed as well as an authentication bypass (CVE-2008-5027).

The remote host is affected by the vulnerability described in GLSA-200907-15 (Nagios: Execution of arbitrary code)

    Multiple vulnerabilities have been reported in Nagios:
    Paul reported that statuswml.cgi does not properly sanitize shell     metacharacters in the (1) ping and (2) traceroute parameters     (CVE-2009-2288).
    Nagios does not properly verify whether an authenticated user is     authorized to run certain commands (CVE-2008-5027).
    Andreas Ericsson reported that Nagios does not perform validity checks     to verify HTTP requests, leading to Cross-Site Request Forgery     (CVE-2008-5028).
    An unspecified vulnerability in Nagios related to CGI programs,     'adaptive external commands,' and 'writing newlines and submitting     service comments' has been reported (CVE-2008-6373).
  Impact :

    A remote authenticated or unauthenticated attacker may exploit these     vulnerabilities to execute arbitrary commands or elevate privileges.
  Workaround :

    There is no known workaround at this time.

It was discovered that Nagios was vulnerable to a Cross-site request forgery (CSRF) vulnerability. If an authenticated nagios user were tricked into clicking a link on a specially crafted web page, an attacker could trigger commands to be processed by Nagios and execute arbitrary programs. This update alters Nagios behaviour by disabling submission of CMD_CHANGE commands. (CVE-2008-5028)

It was discovered that Nagios did not properly parse commands submitted using the web interface. An authenticated user could use a custom form or a browser addon to bypass security restrictions and submit unauthorized commands. (CVE-2008-5027).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upstream has released a new version: * Security fix for Cross Site Request Forgery (CSRF) bug reported by Tim Starling. * Sample audio files for CGIs removed from distribution * Fix for mutliline config file continuation bug * Minor fix to RPM spec file * Fix for AIX compiler warnings * Minor sample config file fix * Added documentation on CGI security issues

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Nagios did not properly parse commands submitted using the web interface. An authenticated user could use a custom form or a browser addon to bypass security restrictions and submit unauthorized commands.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

securityfocus reports :

An attacker with low-level privileges may exploit this issue to bypass authorization and cause arbitrary commands to run within the context of the Nagios server. This may aid in further attacks.

ID	Name	Product	Family	Severity
40281	openSUSE Security Update : nagios (nagios-531)	Nessus	SuSE Local Security Checks	medium
40077	openSUSE Security Update : nagios (nagios-531)	Nessus	SuSE Local Security Checks	medium
39869	GLSA-200907-15 : Nagios: Execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
37968	Ubuntu 8.04 LTS : nagios2 vulnerabilities (USN-698-3)	Nessus	Ubuntu Local Security Checks	medium
37447	Ubuntu 8.10 : nagios3 vulnerabilities (USN-698-2)	Nessus	Ubuntu Local Security Checks	medium
37222	Fedora 10 : nagios-3.0.5-1.fc10 (2008-10323)	Nessus	Fedora Local Security Checks	medium
36674	Ubuntu 6.06 LTS : nagios vulnerability (USN-698-1)	Nessus	Ubuntu Local Security Checks	medium
35344	FreeBSD : nagios -- web interface privilege escalation vulnerability (d4a358d3-e09a-11dd-a765-0030843d3802)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2008-5027

high

Tenable Plugins

medium

medium

high

medium

medium

medium

medium

medium