Detections
Analytics
openSUSE Security Update : monit (openSUSE-2016-1339) (POODLE)
medium Nessus Plugin ID 95272
Language:
Synopsis
The remote openSUSE host is missing a security update.Description
This update for monit fixes the following issues :- CVE-2016-7067: A malicious attacker could have used a cross-site request forgery vulnerability to trick an authenticated user to perform monit actions.
Monit was updated to 5.20, containing all upstream improvements and bug fixes.
The following tracked packaging bugs were fixed :
- disable sslv3 according to RFC7568 (boo#974763)
- fixed pid file directory (boo#971647)
Solution
Update the affected monit packages.See Also
https://bugzilla.opensuse.org/show_bug.cgi?id=1007455
Plugin Details
Severity: Medium
ID: 95272
File Name: openSUSE-2016-1339.nasl
Version: 3.6
Type: local
Agent: unix
Family: SuSE Local Security Checks
Published: 11/23/2016
Updated: 6/28/2023
Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.1
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Vulnerability Information
CPE: cpe:/o:novell:opensuse:13.2, p-cpe:/a:novell:opensuse:monit-debuginfo, cpe:/o:novell:opensuse:42.2, cpe:/o:novell:opensuse:42.1, p-cpe:/a:novell:opensuse:monit-debugsource, p-cpe:/a:novell:opensuse:monit
Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/22/2016
Vulnerability Publication Date: 10/15/2014
Reference Information
CVE: CVE-2014-3566, CVE-2016-7067