full-disclosure - [USN-698-1] Nagios vulnerability

Open Source and information security mailing list archives

Date: Mon, 22 Dec 2008 09:35:54 -0500
From: Marc Deslauriers <marc.deslauriers@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-698-1] Nagios vulnerability

===========================================================
Ubuntu Security Notice USN-698-1          December 22, 2008
nagios vulnerability
CVE-2008-5027
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  nagios-common                   2:1.3-cvs.20050402-8ubuntu8

After a standard system upgrade you need to restart Nagios to effect
the necessary changes.

Details follow:

It was discovered that Nagios did not properly parse commands submitted using
the web interface. An authenticated user could use a custom form or a browser
addon to bypass security restrictions and submit unauthorized commands.

Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios_1.3-cvs.20050402-8ubuntu8.diff.gz
      Size/MD5:    70914 96d8036bdb33aadd3141715039c91b24
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios_1.3-cvs.20050402-8ubuntu8.dsc
      Size/MD5:      959 0393336015bf452f5dfeb74d75245311
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios_1.3-cvs.20050402.orig.tar.gz
      Size/MD5:  1621251 0f92b7b8e705411b7881d3650cbb5d56

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-common_1.3-cvs.20050402-8ubuntu8_all.deb
      Size/MD5:  1218132 d18e298ee16f4c6c6b7c5969c46044e6

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3-cvs.20050402-8ubuntu8_amd64.deb
      Size/MD5:  1030206 085483fdefd0d7bc43e55dbc5be2bcd6
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3-cvs.20050402-8ubuntu8_amd64.deb
      Size/MD5:  1041656 09fc7bb2ff11062603680d09e290909b
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-cvs.20050402-8ubuntu8_amd64.deb
      Size/MD5:  1025618 61619d13effd9a4970486abf5933c756

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3-cvs.20050402-8ubuntu8_i386.deb
      Size/MD5:   877846 544afaebec24e7e94d2ce1da3a89346c
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3-cvs.20050402-8ubuntu8_i386.deb
      Size/MD5:   886544 411d3ca5a204aa41a4a42ef6e5f56453
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-cvs.20050402-8ubuntu8_i386.deb
      Size/MD5:   872936 aa31f6d1fb8a081a206eae3d6bfb3dd6

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3-cvs.20050402-8ubuntu8_powerpc.deb
      Size/MD5:  1015630 540a27062c7f8612b7f460b2bcfd93b9
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3-cvs.20050402-8ubuntu8_powerpc.deb
      Size/MD5:  1024374 47e0480006df0b20a83f67b56da7a9f8
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-cvs.20050402-8ubuntu8_powerpc.deb
      Size/MD5:   993324 03a67a7675075050a672a4c515e8e0c3

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3-cvs.20050402-8ubuntu8_sparc.deb
      Size/MD5:   918810 7340348f043dd884c88bd016ee30e41d
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3-cvs.20050402-8ubuntu8_sparc.deb
      Size/MD5:   926172 e9ccf388b828a17e868807aa39cb5b51
    http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-cvs.20050402-8ubuntu8_sparc.deb
      Size/MD5:   917374 c88dec0d93f590f8a93ebbc701696f68

Download attachment "signature.asc" of type "application/pgp-signature" (198 bytes)

-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@...ts.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives