Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart_ plugin.

[ Christoph Biedl ]

  - munin-node: more secure state file handling, introducing     a new plugin state directory root, owned by uid 0. Then     each plugin runs in its own UID plugin state directory,     owned by that UID. (Closes: #684075), (Closes: #679897),     closes CVE-2012-3512.

  - plugins: use runtime $ENV{MUNIN_PLUGSTATE}. So all     properly written plugins will use     /var/lib/munin-node/plugin-state/$uid/$some_file now -     please report plugins that are still using     /var/lib/munin/plugin-state/ - as those might pose a     security risk!

  - Validate multigraph plugin name, CVE-2013-6048.

  - Don't abort data collection for a node due to malicious     node, fixing munin#1397, CVE-2013-6359.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201405-17 (Munin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Munin. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local attacker could perform symlink attacks to overwrite arbitrary       files with the privileges of the user running the application.
    A remote attacker could create files or load new Munin configuration       files.
  Workaround :

    There is no known workaround at this time.

Munin is a networked resource monitoring tool. Versions of Munin prior to 2.0.6 are affected by the following vulnerabilities :

  - The qmailscan plugin allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names (CVE-2012-2103).
  - Munin stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart_ plugin (CVE-2012-3512).
  - munin-cgi-graph, when running as a CGI module under Apache, allows remote attackers to load new configurations and create files in arbitrary directories via the logdir command (CVE-2012-3513)

Updated munin packages fix security vulnerabilities :

The qmailscan plugin for Munin before 2.0 rc6 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names (CVE-2012-2103).

Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart_ plugin (CVE-2012-3512).

munin-cgi-graph in Munin before 2.0.6, when running as a CGI module under Apache, allows remote attackers to load new configurations and create files in arbitrary directories via the logdir command (CVE-2012-3513).

It was discovered that the Munin qmailscan plugin incorrectly handled temporary files. A local attacker could use this issue to possibly overwrite arbitrary files. This issue only affected Ubuntu 10.04 LTS, Ubuntu 11.10, and Ubuntu 12.04 LTS. (CVE-2012-2103)

It was discovered that Munin incorrectly handled plugin state file permissions. An attacker obtaining privileges of the munin user could use this issue to escalate privileges to root. (CVE-2012-3512)

It was discovered that Munin incorrectly handled specifying an alternate configuration file. A remote attacker could possibly use this issue to execute arbitrary code with the privileges of the web server. This issue only affected Ubuntu 12.10. (CVE-2012-3513).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

added DBDIRNODE for munin-node and remove File::Path as it is no longer needed. Update to 2.0.6, and bug fixes Added init files for asyncd Updated to 2.0.5 Update to munin 2

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 2.0.6, and bug fixes Added init files for asyncd

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
82168	Debian DLA-20-1 : munin security update	Nessus	Debian Local Security Checks	high
74059	GLSA-201405-17 : Munin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
69620	Amazon Linux AMI : munin (ALAS-2012-130)	Nessus	Amazon Linux Local Security Checks	high
6948	Munin Resource Monitoring < 2.0.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	low
66117	Mandriva Linux Security Advisory : munin (MDVSA-2013:105)	Nessus	Mandriva Local Security Checks	high
62816	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : munin vulnerabilities (USN-1622-1)	Nessus	Ubuntu Local Security Checks	high
62321	Fedora 17 : munin-2.0.6-2.fc17 (2012-13683)	Nessus	Fedora Local Security Checks	high
62319	Fedora 16 : munin-2.0.6-2.fc16 (2012-13649)	Nessus	Fedora Local Security Checks	high
62143	Fedora 18 : munin-2.0.6-1.fc18 (2012-13110)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2012-3512

high

Tenable Plugins

high

high

high

low

high

high

high

high

high