Detections
Analytics
Mandriva Linux Security Advisory : nagios (MDVSA-2014:004)
medium Nessus Plugin ID 72019
Language:
Synopsis
The remote Mandriva Linux host is missing one or more security updates.Description
Multiple vulnerabilities has been discovered and corrected in nagios :Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read (CVE-2013-7108).
Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read (CVE-2013-7205).
The updated packages have been patched to correct these issues.
Solution
Update the affected nagios, nagios-devel and / or nagios-www packages.Plugin Details
Severity: Medium
ID: 72019
File Name: mandriva_MDVSA-2014-004.nasl
Version: 1.5
Type: local
Family: Mandriva Local Security Checks
Published: 1/19/2014
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.0
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P
Vulnerability Information
CPE: p-cpe:/a:mandriva:linux:nagios, p-cpe:/a:mandriva:linux:nagios-devel, p-cpe:/a:mandriva:linux:nagios-www, cpe:/o:mandriva:business_server:1
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 1/16/2014
Reference Information
CVE: CVE-2013-7108, CVE-2013-7205
MDVSA: 2014:004