statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.

It was discovered that the statuswml.cgi script of nagios, a monitoring and management system for hosts, services and networks, is prone to a command injection vulnerability. Input to the ping and traceroute parameters of the script is not properly validated which allows an attacker to execute arbitrary shell commands by passing a crafted value to these parameters.

A shell injection bug in nagios' statuswml.cgi CGI script has been fixed. CVE-2009-2288 has been assigned to this issue.

The remote host is affected by the vulnerability described in GLSA-200907-15 (Nagios: Execution of arbitrary code)

    Multiple vulnerabilities have been reported in Nagios:
    Paul reported that statuswml.cgi does not properly sanitize shell     metacharacters in the (1) ping and (2) traceroute parameters     (CVE-2009-2288).
    Nagios does not properly verify whether an authenticated user is     authorized to run certain commands (CVE-2008-5027).
    Andreas Ericsson reported that Nagios does not perform validity checks     to verify HTTP requests, leading to Cross-Site Request Forgery     (CVE-2008-5028).
    An unspecified vulnerability in Nagios related to CGI programs,     'adaptive external commands,' and 'writing newlines and submitting     service comments' has been reported (CVE-2008-6373).
  Impact :

    A remote authenticated or unauthenticated attacker may exploit these     vulnerabilities to execute arbitrary commands or elevate privileges.
  Workaround :

    There is no known workaround at this time.

It was discovered that Nagios did not properly parse certain commands submitted using the WAP web interface. An authenticated user could exploit this flaw and execute arbitrary programs on the server.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Secunia reports :

A vulnerability has been reported in Nagios, which can be exploited by malicious users to potentially compromise a vulnerable system.

Input passed to the 'ping' parameter in statuswml.cgi is not properly sanitised before being used to invoke the ping command. This can be exploited to inject and execute arbitrary shell commands.

Successful exploitation requires access to the ping feature of the WAP interface.

ID	Name	Product	Family	Severity
44690	Debian DSA-1825-1 : nagios2, nagios3 - insufficient input validation	Nessus	Debian Local Security Checks	high
42024	openSUSE 10 Security Update : nagios (nagios-6355)	Nessus	SuSE Local Security Checks	high
41561	SuSE 10 Security Update : nagios (ZYPP Patch Number 6356)	Nessus	SuSE Local Security Checks	high
41439	SuSE 11 Security Update : nagios (SAT Patch Number 1105)	Nessus	SuSE Local Security Checks	high
40445	openSUSE Security Update : nagios (nagios-1102)	Nessus	SuSE Local Security Checks	high
40443	openSUSE Security Update : nagios (nagios-1102)	Nessus	SuSE Local Security Checks	high
39869	GLSA-200907-15 : Nagios: Execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
39601	Ubuntu 8.04 LTS / 8.10 / 9.04 : nagios2, nagios3 vulnerability (USN-795-1)	Nessus	Ubuntu Local Security Checks	high
39578	FreeBSD : nagios -- Command Injection Vulnerability (3ebd4cb5-657f-11de-883a-00e0815b8da8)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2009-2288

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high