The automatic update request in Nagstamont before 0.9.10 uses a cleartext base64 format for transmission of a username and password, which allows remote attackers to obtain sensitive information by sniffing the network.

- update to 0.9.10 :

  + added fullscreen option

  + added Thruk support

  + added Check_MK cookie-based auth

  + added new Centreon autologin option

  + added configurable default sort order

  + added filter for hosts in hard/soft state for Nagios,     Icinga, Opsview and Centreon

  + added $STATUS-INFO$ variable for custom actions

  + added audio alarms also in fullscreen mode

  + improved update interval set in seconds instead minutes

  + improved Icinga JSON support

  + improved Centreon 2.4 xml/broker support

  + improved Nagios 3.4 pagination support

  + improved nicer GTK theme Murrine on MacOSX

  + fixed security bug

  + fixed some memory leaks

  + fixed superfluous passive icon for Check_MK

  + fixed blocking of shutdown/reboot on MacOSX

  + fixed saving converted pre 0.9.9 config immediately

  + fixed statusbar position when offscreen

  + fixed some GUI issues

  + fixed update detection

  - this version fixes a security bug in the automatic     update check (mentioned in CVE-2013-4114 and bnc     #829217)

  - fix build on CentOS > 5

The remote host is affected by the vulnerability described in GLSA-201401-03 (Nagstamon: Information disclosure)

    Nagstamon&rsquo;s automatic request to check for updates includes plaintext       username and password information for one of the monitor servers that the       Nagstamon instance connects to.
  Impact :

    A remote attacker could eavesdrop on this request and gain user       credentials for a monitor server.
  Workaround :

    There is no known workaround at this time.

Added patch for fix security hole in updates-checking mechanism

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75094	openSUSE Security Update : nagstamon (openSUSE-SU-2013:1235-1)	Nessus	SuSE Local Security Checks	medium
71810	GLSA-201401-03 : Nagstamon: Information disclosure	Nessus	Gentoo Local Security Checks	medium
68895	Fedora 18 : nagstamon-0.9.9-9.fc18 (2013-12541)	Nessus	Fedora Local Security Checks	medium
68894	Fedora 19 : nagstamon-0.9.9-9.fc19 (2013-12526)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4114

high

Tenable Plugins

medium

medium

medium

medium