Cross-site request forgery (CSRF) vulnerability in cmd.cgi in (1) Nagios 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote attackers to send commands to the Nagios process, and trigger execution of arbitrary programs by this process, via unspecified HTTP requests.

A CSRF bug in nagios' cmd.cgi (CVE-2008-5028) has been fixed as well as an authentication bypass (CVE-2008-5027).

The remote host is affected by the vulnerability described in GLSA-200907-15 (Nagios: Execution of arbitrary code)

    Multiple vulnerabilities have been reported in Nagios:
    Paul reported that statuswml.cgi does not properly sanitize shell     metacharacters in the (1) ping and (2) traceroute parameters     (CVE-2009-2288).
    Nagios does not properly verify whether an authenticated user is     authorized to run certain commands (CVE-2008-5027).
    Andreas Ericsson reported that Nagios does not perform validity checks     to verify HTTP requests, leading to Cross-Site Request Forgery     (CVE-2008-5028).
    An unspecified vulnerability in Nagios related to CGI programs,     'adaptive external commands,' and 'writing newlines and submitting     service comments' has been reported (CVE-2008-6373).
  Impact :

    A remote authenticated or unauthenticated attacker may exploit these     vulnerabilities to execute arbitrary commands or elevate privileges.
  Workaround :

    There is no known workaround at this time.

It was discovered that Nagios was vulnerable to a Cross-site request forgery (CSRF) vulnerability. If an authenticated nagios user were tricked into clicking a link on a specially crafted web page, an attacker could trigger commands to be processed by Nagios and execute arbitrary programs. This update alters Nagios behaviour by disabling submission of CMD_CHANGE commands. (CVE-2008-5028)

It was discovered that Nagios did not properly parse commands submitted using the web interface. An authenticated user could use a custom form or a browser addon to bypass security restrictions and submit unauthorized commands. (CVE-2008-5027).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
40281	openSUSE Security Update : nagios (nagios-531)	Nessus	SuSE Local Security Checks	medium
40077	openSUSE Security Update : nagios (nagios-531)	Nessus	SuSE Local Security Checks	medium
39869	GLSA-200907-15 : Nagios: Execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
37968	Ubuntu 8.04 LTS : nagios2 vulnerabilities (USN-698-3)	Nessus	Ubuntu Local Security Checks	medium
37447	Ubuntu 8.10 : nagios3 vulnerabilities (USN-698-2)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2008-5028

high

Tenable Plugins

medium

medium

high

medium

medium