7.5 - GLSA-200907-15

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	Nagios: Execution of arbitrary code

Informations
Name	GLSA-200907-15	First vendor Publication	2009-07-19
Vendor	Gentoo	Last vendor Modification	2009-07-19
Severity (Vendor)	High	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

Multiple vulnerabilities in Nagios may lead to the execution of arbitrary code.

Background

Nagios is an open source host, service and network monitoring program.

Description

Multiple vulnerabilities have been reported in Nagios:

* Paul reported that statuswml.cgi does not properly sanitize shell metacharacters in the (1) ping and (2) traceroute parameters (CVE-2009-2288).

* Nagios does not properly verify whether an authenticated user is authorized to run certain commands (CVE-2008-5027).

* Andreas Ericsson reported that Nagios does not perform validity checks to verify HTTP requests, leading to Cross-Site Request Forgery (CVE-2008-5028).

* An unspecified vulnerability in Nagios related to CGI programs,
"adaptive external commands," and "writing newlines and submitting service comments" has been reported (CVE-2008-6373).

Impact

A remote authenticated or unauthenticated attacker may exploit these vulnerabilities to execute arbitrary commands or elevate privileges.

Workaround

There is no known workaround at this time.

Resolution

All Nagios users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=net-analyzer/nagios-core-3.0.6-r2"

NOTE: Users of the Nagios 2 branch can update to version 2.12-r1 which contains a patch to fix CVE-2009-2288. However, that branch is not supported upstream or in Gentoo and we are unaware whether the other vulnerabilities affect 2.x installations.

References

[ 1 ] CVE-2008-5027 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5027
[ 2 ] CVE-2008-5028 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5028
[ 3 ] CVE-2008-6373 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6373
[ 4 ] CVE-2009-2288 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2288

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200907-15.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-200907-15.xml

CAPEC : Common Attack Pattern Enumeration & Classification

Id	Name
CAPEC-1	Accessing Functionality Not Properly Constrained by ACLs
CAPEC-13	Subverting Environment Variable Values
CAPEC-17	Accessing, Modifying or Executing Executable Files
CAPEC-39	Manipulating Opaque Client-based Data Tokens
CAPEC-45	Buffer Overflow via Symbolic Links
CAPEC-51	Poison Web Service Registry
CAPEC-59	Session Credential Falsification through Prediction
CAPEC-60	Reusing Session IDs (aka Session Replay)
CAPEC-76	Manipulating Input to File System Calls
CAPEC-77	Manipulating User-Controlled Variables
CAPEC-87	Forceful Browsing
CAPEC-104	Cross Zone Scripting

CWE : Common Weakness Enumeration

%	Id	Name
25 %	CWE-352	Cross-Site Request Forgery (CSRF) (CWE/SANS Top 25)
25 %	CWE-264	Permissions, Privileges, and Access Controls
25 %	CWE-94	Failure to Control Generation of Code ('Code Injection')
25 %	CWE-78	Improper Sanitization of Special Elements used in an OS Command ('OS Command Injection') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:13385

Oval ID:	oval:org.mitre.oval:def:13385
Title:	DSA-1825-1 nagios2, nagios3 -- insufficient input validation
Description:	It was discovered that the statuswml.cgi script of nagios, a monitoring and management system for hosts, services and networks, is prone to a command injection vulnerability. Input to the ping and trace route parameters of the script is not properly validated which allows an attacker to execute arbitrary shell commands by passing a crafted value to these parameters. For the oldstable distribution, this problem has been fixed in version 2.6-2+etch3 of nagios2. For the stable distribution, this problem has been fixed in version 3.0.6-4~lenny2 of nagios3. For the testing distribution, this problem has been fixed in version 3.0.6-5 of nagios3. For the unstable distribution, this problem has been fixed in version 3.0.6-5 of nagios3. We recommend that you upgrade your nagios2/nagios3 packages.
Family:	unix	Class:	patch
Reference(s):	DSA-1825-1 CVE-2009-2288	Version:	5
Platform(s):	Debian GNU/Linux 5.0	Product(s):	nagios2 nagios3
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Architecture section Architecture independent section Installed architecture is all AND Packages section nagios3-doc DPKG is earlier than 3.0.6-4~lenny2 AND nagios3-common DPKG is earlier than 3.0.6-4~lenny2 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section nagios3-dbg DPKG is earlier than 3.0.6-4~lenny2 AND nagios3 DPKG is earlier than 3.0.6-4~lenny2

Definition Id: oval:org.mitre.oval:def:13626

Oval ID:	oval:org.mitre.oval:def:13626
Title:	USN-795-1 -- nagios2, nagios3 vulnerability
Description:	It was discovered that Nagios did not properly parse certain commands submitted using the WAP web interface. An authenticated user could exploit this flaw and execute arbitrary programs on the server.
Family:	unix	Class:	patch
Reference(s):	USN-795-1 CVE-2009-2288	Version:	5
Platform(s):	Ubuntu 8.10 Ubuntu 8.04 Ubuntu 9.04	Product(s):	nagios2 nagios3
Definition Synopsis:
Release section Ubuntu 8.10 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section nagios3-doc DPKG is earlier than 3.0.2-1ubuntu1.2 AND nagios3-common DPKG is earlier than 3.0.2-1ubuntu1.2 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section nagios3-dbg DPKG is earlier than 3.0.2-1ubuntu1.2 AND nagios3 DPKG is earlier than 3.0.2-1ubuntu1.2 OR Release section Ubuntu 8.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section nagios2-doc DPKG is earlier than 2.11-1ubuntu1.5 AND nagios2-common DPKG is earlier than 2.11-1ubuntu1.5 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section nagios2-dbg DPKG is earlier than 2.11-1ubuntu1.5 AND nagios2 DPKG is earlier than 2.11-1ubuntu1.5 OR Release section Ubuntu 9.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section nagios3-doc DPKG is earlier than 3.0.6-2ubuntu1.1 AND nagios3-common DPKG is earlier than 3.0.6-2ubuntu1.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section nagios3-dbg DPKG is earlier than 3.0.6-2ubuntu1.1 AND nagios3 DPKG is earlier than 3.0.6-2ubuntu1.1

Definition Id: oval:org.mitre.oval:def:20295

Oval ID:	oval:org.mitre.oval:def:20295
Title:	USN-698-2 -- nagios3 vulnerabilities
Description:	It was discovered that Nagios was vulnerable to a Cross-site request forgery (CSRF) vulnerability.
Family:	unix	Class:	patch
Reference(s):	USN-698-2 CVE-2008-5028 CVE-2008-5027	Version:	5
Platform(s):	Ubuntu 8.10	Product(s):	nagios3
Definition Synopsis:
Ubuntu 8.10 is installed AND nagios3 DPKG is earlier than 0:3.0.2-1ubuntu1.1

Definition Id: oval:org.mitre.oval:def:20718

Oval ID:	oval:org.mitre.oval:def:20718
Title:	USN-698-3 -- nagios2 vulnerabilities
Description:	It was discovered that Nagios was vulnerable to a Cross-site request forgery (CSRF) vulnerability.
Family:	unix	Class:	patch
Reference(s):	USN-698-3 CVE-2008-5028 CVE-2008-5027	Version:	5
Platform(s):	Ubuntu 8.04	Product(s):	nagios2
Definition Synopsis:
Ubuntu 8.04 is installed AND nagios2 DPKG is earlier than 0:2.11-1ubuntu1.4

Definition Id: oval:org.mitre.oval:def:21043

Oval ID:	oval:org.mitre.oval:def:21043
Title:	USN-698-1 -- nagios vulnerability
Description:	It was discovered that Nagios did not properly parse commands submitted using the web interface.
Family:	unix	Class:	patch
Reference(s):	USN-698-1 CVE-2008-5027	Version:	5
Platform(s):	Ubuntu 6.06	Product(s):	nagios
Definition Synopsis:
Ubuntu 6.06 is installed AND nagios-common DPKG is earlier than 2:1.3-cvs.20050402-8ubuntu8

Definition Id: oval:org.mitre.oval:def:8200

Oval ID:	oval:org.mitre.oval:def:8200
Title:	DSA-1825 nagios2, nagios3 -- insufficient input validation
Description:	It was discovered that the statuswml.cgi script of nagios, a monitoring and management system for hosts, services and networks, is prone to a command injection vulnerability. Input to the ping and traceroute parameters of the script is not properly validated which allows an attacker to execute arbitrary shell commands by passing a crafted value to these parameters.
Family:	unix	Class:	patch
Reference(s):	DSA-1825 CVE-2009-2288	Version:	3
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	nagios2 nagios3
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section nagios3-doc is earlier than 3.0.6-4~lenny2 AND nagios3-common is earlier than 3.0.6-4~lenny2 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section nagios3-dbg is earlier than 3.0.6-4~lenny2 AND nagios3 is earlier than 3.0.6-4~lenny2 OR Release section Debian GNU/Linux 4.0 is installed. AND Architecture section Architecture independent section Installed architecture is all AND Packages section nagios2-common is earlier than 2.6-2+etch3 AND nagios2-doc is earlier than 2.6-2+etch3 AND nagios2-dbg is earlier than 2.6-2+etch3 AND nagios2 is earlier than 2.6-2+etch3

CPE : Common Platform Enumeration

Type	Description	Count
Application	Nagios cpe:2.3:a:nagios:nagios:3.1.0:::::::* cpe:2.3:a:nagios:nagios:3.0.6:::::::* cpe:2.3:a:nagios:nagios:3.0.5:::::::* cpe:2.3:a:nagios:nagios:3.0.4:::::::* cpe:2.3:a:nagios:nagios:3.0.3:::::::* cpe:2.3:a:nagios:nagios:3.0.2:::::::* cpe:2.3:a:nagios:nagios:3.0.1:::::::* cpe:2.3:a:nagios:nagios:3.0:alpha4:::::: cpe:2.3:a:nagios:nagios:3.0:beta1:::::: cpe:2.3:a:nagios:nagios:3.0:alpha3:::::: cpe:2.3:a:nagios:nagios:3.0:::::::* cpe:2.3:a:nagios:nagios:3.0:rc3:::::: cpe:2.3:a:nagios:nagios:3.0:beta2:::::: cpe:2.3:a:nagios:nagios:3.0:alpha2:::::: cpe:2.3:a:nagios:nagios:3.0:beta7:::::: cpe:2.3:a:nagios:nagios:3.0:rc1:::::: cpe:2.3:a:nagios:nagios:3.0:beta5:::::: cpe:2.3:a:nagios:nagios:3.0:beta4:::::: cpe:2.3:a:nagios:nagios:3.0:alpha5:::::: cpe:2.3:a:nagios:nagios:3.0:alpha1:::::: cpe:2.3:a:nagios:nagios:3.0:rc2:::::: cpe:2.3:a:nagios:nagios:3.0:beta3:::::: cpe:2.3:a:nagios:nagios:3.0:beta6:::::: cpe:2.3:a:nagios:nagios:2.9:::::::* cpe:2.3:a:nagios:nagios:2.8:::::::* cpe:2.3:a:nagios:nagios:2.7:::::::* cpe:2.3:a:nagios:nagios:2.5:::::::* cpe:2.3:a:nagios:nagios:2.4:::::::* cpe:2.3:a:nagios:nagios:2.3.1:::::::* cpe:2.3:a:nagios:nagios:2.3:::::::* cpe:2.3:a:nagios:nagios:2.2:::::::* cpe:2.3:a:nagios:nagios:2.11:::::::* cpe:2.3:a:nagios:nagios:2.10:::::::* cpe:2.3:a:nagios:nagios:2.1.3:::::::* cpe:2.3:a:nagios:nagios:2.1:::::::* cpe:2.3:a:nagios:nagios:2.0rc2:::::::* cpe:2.3:a:nagios:nagios:2.0rc1:::::::* cpe:2.3:a:nagios:nagios:2.0b6:::::::* cpe:2.3:a:nagios:nagios:2.0b5:::::::* cpe:2.3:a:nagios:nagios:2.0b4:::::::* cpe:2.3:a:nagios:nagios:2.0b3:::::::* cpe:2.3:a:nagios:nagios:2.0b2:::::::* cpe:2.3:a:nagios:nagios:2.0b1:::::::* cpe:2.3:a:nagios:nagios:2.0.2:::::::* cpe:2.3:a:nagios:nagios:2.0.1:::::::* cpe:2.3:a:nagios:nagios:2.0:::::::* cpe:2.3:a:nagios:nagios:1.4.1:::::::* cpe:2.3:a:nagios:nagios:1.4:::::::* cpe:2.3:a:nagios:nagios:1.3:::::::* cpe:2.3:a:nagios:nagios:1.2:::::::* cpe:2.3:a:nagios:nagios:1.1:::::::* cpe:2.3:a:nagios:nagios:1.0b6:::::::* cpe:2.3:a:nagios:nagios:1.0b5:::::::* cpe:2.3:a:nagios:nagios:1.0b4:::::::* cpe:2.3:a:nagios:nagios:1.0b3:::::::* cpe:2.3:a:nagios:nagios:1.0b2:::::::* cpe:2.3:a:nagios:nagios:1.0b1:::::::* cpe:2.3:a:nagios:nagios:1.0_b3:::::::* cpe:2.3:a:nagios:nagios:1.0_b2:::::::* cpe:2.3:a:nagios:nagios:1.0_b1:::::::* cpe:2.3:a:nagios:nagios:1.0:::::::* cpe:2.3:a:nagios:nagios:::::::: cpe:2.3:a:nagios:nagios:-:::::::*	63
Application	op5 Monitor cpe:2.3:a:op5:monitor:3.3.3:::::::* cpe:2.3:a:op5:monitor:3.3.2:::::::* cpe:2.3:a:op5:monitor:3.3.1:::::::* cpe:2.3:a:op5:monitor:3.2.4:::::::* cpe:2.3:a:op5:monitor:3.2:::::::* cpe:2.3:a:op5:monitor:3.0.0:::::::* cpe:2.3:a:op5:monitor:3.0:::::::* cpe:2.3:a:op5:monitor:2.8:::::::* cpe:2.3:a:op5:monitor:2.6:::::::* cpe:2.3:a:op5:monitor:2.4:::::::*	10

SAINT Exploits

Description	Link
Nagios statuswml.cgi Command Injection	More info here

OpenVAS Exploits

Date	Description
2009-10-13	Name : SLES10: Security update for nagios File : nvt/sles10_nagios.nasl
2009-10-11	Name : SLES11: Security update for nagios File : nvt/sles11_nagios.nasl
2009-08-17	Name : SuSE Security Summary SUSE-SR:2009:013 File : nvt/suse_sr_2009_013.nasl
2009-08-17	Name : Mandrake Security Advisory MDVSA-2009:187 (nagios) File : nvt/mdksa_2009_187.nasl
2009-07-29	Name : Gentoo Security Advisory GLSA 200907-15 (nagios-core) File : nvt/glsa_200907_15.nasl
2009-07-08	Name : Nagios 'statuswml.cgi' Remote Arbitrary Shell Command Injection Vulnerability File : nvt/nagios_35464.nasl
2009-07-06	Name : Ubuntu USN-795-1 (nagios3) File : nvt/ubuntu_795_1.nasl
2009-07-06	Name : FreeBSD Ports: nagios File : nvt/freebsd_nagios1.nasl
2009-07-06	Name : Debian Security Advisory DSA 1825-1 (nagios2, nagios3) File : nvt/deb_1825_1.nasl
2009-06-05	Name : Ubuntu USN-698-3 (nagios2) File : nvt/ubuntu_698_3.nasl
2009-06-05	Name : Ubuntu USN-698-1 (nagios) File : nvt/ubuntu_698_1.nasl
2009-05-06	Name : Nagios Web Interface Privilege Escalation Vulnerability File : nvt/nagios_cve_2008_5027.nasl
2009-05-06	Name : Nagios External Commands and Adaptive Commands Unspecified Vulnerability File : nvt/nagios_cve_2008_6373.nasl
2009-03-23	Name : Ubuntu Update for nagios2 vulnerabilities USN-698-3 File : nvt/gb_ubuntu_USN_698_3.nasl
2009-03-23	Name : Ubuntu Update for nagios vulnerability USN-698-1 File : nvt/gb_ubuntu_USN_698_1.nasl
2009-02-16	Name : Fedora Update for nagios FEDORA-2008-10323 File : nvt/gb_fedora_2008_10323_nagios_fc10.nasl
2009-01-13	Name : FreeBSD Ports: nagios File : nvt/freebsd_nagios0.nasl
2008-12-29	Name : Ubuntu USN-697-1 (imlib2) File : nvt/ubuntu_697_1.nasl
2008-12-29	Name : Ubuntu USN-698-2 (nagios3) File : nvt/ubuntu_698_2.nasl
2008-12-29	Name : Ubuntu USN-699-1 (blender) File : nvt/ubuntu_699_1.nasl
2008-11-27	Name : Nagios Cross-site Request Forgery (CSRF) and Authentication Bypass Vulnerability File : nvt/gb_nagios_csrf_n_auth_bypass_vuln.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
55281	Nagios statuswml.cgi Multiple Parameter Arbitrary Remote Shell Command Execution A command injection flaw exists in Nagios. The statuswml.cgi script fails to sanitize data passed to the 'ping' and 'traaceroute' commands resulting in shell command execution via metacharacters. With a specially crafted request, a remote attacker can cause arbitrary code execution resulting in a loss of integrity.
50457	Nagios Unspecified CGI Issue
50242	op5 Nagios Process Browser Addon Remote Authentication Bypass
50241	op5 Nagios Process Custom Form Remote Authentication Bypass
50240	Nagios Nagios Process Browser Addon Remote Authentication Bypass
50239	Nagios Nagios Process Custom Form Remote Authentication Bypass
49994	op5 Monitor Unspecified CSRF
49991	Nagios Unspecified CSRF

Snort® IPS/IDS

Date	Description
2014-02-08	Nagios3 statuswml.cgi remote command execution attempt RuleID : 29267 - Revision : 3 - Type : SERVER-WEBAPP
2014-01-10	Nagios3 statuswml.cgi remote command execution attempt RuleID : 26274 - Revision : 5 - Type : SERVER-WEBAPP

Nessus® Vulnerability Scanner

Date	Description
2010-02-24	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1825.nasl - Type : ACT_GATHER_INFO
2009-10-06	Name : The remote openSUSE host is missing a security update. File : suse_nagios-6355.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_nagios-090715.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_nagios-6356.nasl - Type : ACT_GATHER_INFO
2009-07-31	Name : The remote openSUSE host is missing a security update. File : suse_11_0_nagios-090715.nasl - Type : ACT_GATHER_INFO
2009-07-31	Name : The remote openSUSE host is missing a security update. File : suse_11_1_nagios-090715.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_nagios-090217.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_1_nagios-090217.nasl - Type : ACT_GATHER_INFO
2009-07-20	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200907-15.nasl - Type : ACT_GATHER_INFO
2009-07-03	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-795-1.nasl - Type : ACT_GATHER_INFO
2009-07-01	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_3ebd4cb5657f11de883a00e0815b8da8.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Fedora host is missing a security update. File : fedora_2008-10323.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-698-1.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-698-2.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-698-3.nasl - Type : ACT_GATHER_INFO
2009-01-12	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_d4a358d3e09a11dda7650030843d3802.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:36:37	Multiple Updates

Global Informations

Type	Count
Capec ID(s)	12
CWE ID(s)	5
Oval ID(s)	6
CPE ID(s)	73
Saint Exploit(s)	1
osvdb(s)	8
Openvas Exploit(s)	21
Snort® Rule(s)	2
Nessus® Exploit(s)	16

	Related
7.5	CVE-2009-2288
6.8	CVE-2008-5028
6.5	CVE-2008-5027
5	CVE-2008-6373
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 4 more Alert(s)