Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an (a) command action or a (b) hosts action.

statusmap.cgi and config.cgi were prone to cross-site scripting (XSS) vulnerabilities (CVE-2011-1523, CVE-2011-2179).

Move the nagios-common's usermod line to the main nagios package. Add php to the requirements list Update to version 3.3.1.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Move the nagios-common's usermod line to the main nagios package Add php to the requirements list Update to version 3.3.1.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Stefan Schurtz discovered than Nagios did not properly sanitize its input when processing certain requests, resulting in cross-site scripting (XSS) vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75971	openSUSE Security Update : nagios (openSUSE-SU-2011:0836-1)	Nessus	SuSE Local Security Checks	medium
69657	Amazon Linux AMI : nagios (ALAS-2012-50)	Nessus	Amazon Linux Local Security Checks	medium
58049	Fedora 16 : nagios-3.3.1-3.fc16 (2012-1592)	Nessus	Fedora Local Security Checks	medium
58048	Fedora 15 : nagios-3.3.1-3.fc15 (2012-1583)	Nessus	Fedora Local Security Checks	medium
55163	Ubuntu 10.04 LTS / 10.10 / 11.04 : nagios3 vulnerabilities (USN-1151-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2011-2179

medium

Tenable Plugins

medium

medium

medium

medium

medium