The get_group_tree function in lib/Munin/Master/HTMLConfig.pm in Munin before 2.0.18 allows remote nodes to cause a denial of service (infinite loop and memory consumption in the munin-html process) via crafted multigraph data.

[ Christoph Biedl ]

  - munin-node: more secure state file handling, introducing     a new plugin state directory root, owned by uid 0. Then     each plugin runs in its own UID plugin state directory,     owned by that UID. (Closes: #684075), (Closes: #679897),     closes CVE-2012-3512.

  - plugins: use runtime $ENV{MUNIN_PLUGSTATE}. So all     properly written plugins will use     /var/lib/munin-node/plugin-state/$uid/$some_file now -     please report plugins that are still using     /var/lib/munin/plugin-state/ - as those might pose a     security risk!

  - Validate multigraph plugin name, CVE-2013-6048.

  - Don't abort data collection for a node due to malicious     node, fixing munin#1397, CVE-2013-6359.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The get_group_tree function in lib/Munin/Master/HTMLConfig.pm in Munin before 2.0.18 allows remote nodes to cause a denial of service (infinite loop and memory consumption in the munin-html process) via crafted multigraph data.

Munin::Master::Node in Munin before 2.0.18 allows remote attackers to cause a denial of service (abort data collection for node) via a plugin that uses 'multigraph' as a multigraph service name.

Upstream released 2.0.20

  - BZ# 1082162: munin-asyncd doesn't get added to chkconfig     minor bugfix release :

  - BZ# 1081254: Start asyncd after node

    - BZ# 1028075: munin-node doesn't get added to chkconfig       Upstream update to 2.0.18, fixes CVE-2013-6359

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Christoph Biedl discovered that Munin incorrectly handled certain multigraph data. A remote attacker could use this issue to cause Munin to consume resources, resulting in a denial of service.
(CVE-2013-6048)

Christoph Biedl discovered that Munin incorrectly handled certain multigraph service names. A remote attacker could use this issue to cause Munin to stop data collection, resulting in a denial of service.
(CVE-2013-6359).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated munin packages fix security vulnerabilities :

The Munin::Master::Node module of munin does not properly validate certain data a node sends. A malicious node might exploit this to drive the munin-html process into an infinite loop with memory exhaustion on the munin master (CVE-2013-6048).

A malicious node, with a plugin enabled using multigraph as a multigraph service name, can abort data collection for the entire node the plugin runs on (CVE-2013-6359).

Upstream update to 2.0.19, fixes CVE-2013-6359

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Christoph Biedl discovered two denial of service vulnerabilities in munin, a network-wide graphing framework. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2013-6048     The Munin::Master::Node module of munin does not     properly validate certain data a node sends. A malicious     node might exploit this to drive the munin-html process     into an infinite loop with memory exhaustion on the     munin master.

  - CVE-2013-6359     A malicious node, with a plugin enabled using     'multigraph' as a multigraph service name, can abort     data collection for the entire node the plugin runs on.

ID	Name	Product	Family	Severity
82168	Debian DLA-20-1 : munin security update	Nessus	Debian Local Security Checks	high
78291	Amazon Linux AMI : munin (ALAS-2014-348)	Nessus	Amazon Linux Local Security Checks	medium
73365	Fedora 20 : munin-2.0.20-1.fc20 (2014-4542)	Nessus	Fedora Local Security Checks	medium
73363	Fedora 19 : munin-2.0.20-1.fc19 (2014-4462)	Nessus	Fedora Local Security Checks	medium
72293	Amazon Linux AMI : munin (ALAS-2014-275)	Nessus	Amazon Linux Local Security Checks	medium
72164	Ubuntu 12.04 LTS / 12.10 / 13.10 : munin vulnerabilities (USN-2090-1)	Nessus	Ubuntu Local Security Checks	medium
71605	Mandriva Linux Security Advisory : munin (MDVSA-2013:297)	Nessus	Mandriva Local Security Checks	medium
71484	Fedora 19 : munin-2.0.19-1.fc19 (2013-23016)	Nessus	Fedora Local Security Checks	medium
71483	Fedora 18 : munin-2.0.19-1.fc18 (2013-22993)	Nessus	Fedora Local Security Checks	medium
71446	Fedora 20 : munin-2.0.19-1.fc20 (2013-22968)	Nessus	Fedora Local Security Checks	medium
71278	Debian DSA-2815-1 : munin - denial of service	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-6048

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium