Nagios Network Analyzer < 2.2.2 Multiple Vulnerabilities

critical Nessus Network Monitor Plugin ID 9602

Synopsis

The remote host is running a version of Nagios Network Analyzer that is affected by multiple attack vectors.

Description

Versions of Nagios Network Analyzer prior to 2.2.2 are vulnerable to the following issues :

- A flaw exists as HTTP requests to '/nagiosna/index.php/api/system/create_command' do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site Request Forgery (CSRF/XSRF) attack causing the victim to execute arbitrary commands.
- A flaw exists that allows a reflected cross-site scripting (XSS) attack. This flaw exists because the '/nagiosna/index.php/sources/queries' script does not validate input to the 'q[qid]' parameter before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
- A flaw exists as HTTP requests to '/nagiosna/index.php/admin/users/create' do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a CSRF/XSRF attack causing the victim to create administrative users.
- A flaw exists as HTTP requests to '/nagiosna/index.php/api/reports/delete' do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a CSRF/XSRF attack causing the victim to delete reports.
- A flaw exists as HTTP requests to '/nagiosna/index.php/api/system/stop' do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a CSRF/XSRF attack causing the victim to stop services.
- A flaw exists as HTTP requests to '/nagiosna/index.php/admin/users/delete' do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a CSRF/XSRF attack causing the victim to delete arbitrary users.
- A flaw exists that may allow carrying out an SQL injection attack. The issue is due to the '/nagiosna/index.php/api/checks/read' script not properly sanitizing input to the 'o[col]' parameter. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.
- A flaw exists that may allow carrying out an SQL injection attack. The issue is due to the '/nagiosna/index.php/api/sources/read' script not properly sanitizing input to the 'o[col]' parameter. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.
- A flaw exists that may allow carrying out an SQL injection attack. The issue is due to the '/nagiosna/index.php/admin/globals' script not properly sanitizing input to the 'timezone' parameter. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.
- A flaw exists in '/nagiosna/index.php/download/report/sourcegroup/' that is triggered as user-supplied input is not properly sanitized. This may allow a remote attacker to execute arbitrary commands.
- A flaw exists in '/nagiosna/index.php/download/report/source/' that is triggered as user-supplied input is not properly sanitized. This may allow a remote attacker to execute arbitrary commands.
- A flaw exists that is due to the program setting insecure permissions for the '/usr/local/nagiosna/bin/rc.py' file. This may allow a local attacker to gain elevated privileges.
- A flaw exists that is due to the program setting insecure permissions for the '/usr/local/nagiosna/scripts/change_timezone.sh' file. This may allow a local attacker to gain elevated privileges.
- A flaw exists that is due to the program setting insecure permissions for the '/usr/local/nagiosna/scripts/upgrade_to_latest.sh' file. This may allow a local attacker to gain elevated privileges.

Solution

Upgrade Network Analyzer to version 2.2.2 or later.

Plugin Details

Severity: Critical

ID: 9602

Family: CGI

Published: 9/30/2016

Updated: 3/6/2019

Vulnerability Information

Patch Publication Date: 7/22/2016

Vulnerability Publication Date: 8/11/2016

Detections

Analytics