Executive Summary

Summary
Title Nagios Plugins: Two buffer overflows
Informations
Name GLSA-200711-11 First vendor Publication 2007-11-08
Vendor Gentoo Last vendor Modification 2007-11-08
Severity (Vendor) High Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score 6.8 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

Two buffer overflow vulnerabilities in the Nagios Plugins might allow for remote execution of arbitrary code.

Background

The Nagios Plugins are an official set of plugins for Nagios, an open source host, service and network monitoring program.

Description

fabiodds reported a boundary checking error in the "check_snmp" plugin when processing SNMP "GET" replies that could lead to a stack-based buffer overflow (CVE-2007-5623). Nobuhiro Ban reported a boundary checking error in the redir() function of the "check_http" plugin when processing HTTP "Location:" header information which might lead to a buffer overflow (CVE-2007-5198).

Impact

A remote attacker could exploit these vulnerabilities to execute arbitrary code with the privileges of the user running Nagios or cause a Denial of Service by (1) sending a specially crafted SNMP "GET" reply to the Nagios daemon or (2) sending an overly long string in the
"Location:" header of an HTTP reply. Note that to exploit (2), the malicious or compromised web server has to be configured in Nagios and the "-f" (follow) option has to be enabled.

Workaround

There is no known workaround at this time.

Resolution

All users of the Nagios Plugins should upgrade to the latest version:
# emerge --sync
# emerge -av --oneshot ">=net-analyzer/nagios-plugins-1.4.10-r1"

References

[ 1 ] CVE-2007-5198 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5198
[ 2 ] CVE-2007-5623 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5623

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200711-11.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-200711-11.xml

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:17513
 
Oval ID: oval:org.mitre.oval:def:17513
Title: USN-532-1 -- nagios-plugins vulnerability
Description: Nobuhiro Ban discovered that check_http in nagios-plugins did not properly sanitize its input when following redirection requests.
Family: unix Class: patch
Reference(s): USN-532-1
CVE-2007-5198
 Version: 7
Platform(s): Ubuntu 6.06
 Product(s): nagios-plugins
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18454
 
Oval ID: oval:org.mitre.oval:def:18454
Title: DSA-1495-1 nagios-plugins - several
Description: Several local/remote vulnerabilities have been discovered in two of the plugins for the Nagios network monitoring and management system.
Family: unix Class: patch
Reference(s): DSA-1495-1
CVE-2007-5198
CVE-2007-5623
 Version: 7
Platform(s): Debian GNU/Linux 4.0
 Product(s): nagios-plugins
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7850
 
Oval ID: oval:org.mitre.oval:def:7850
Title: DSA-1495 nagios-plugins -- buffer overflows
Description: Several local/remote vulnerabilities have been discovered in two of the plugins for the Nagios network monitoring and management system. The Common Vulnerabilities and Exposures project identifies the following problems: A buffer overflow has been discovered in the parser for HTTP Location headers (present in the check_http module). A buffer overflow has been discovered in the check_snmp module.
Family: unix Class: patch
Reference(s): DSA-1495
CVE-2007-5198
CVE-2007-5623
 Version: 3
Platform(s): Debian GNU/Linux 4.0
Debian GNU/Linux 3.1
 Product(s): nagios-plugins
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1

OpenVAS Exploits

Date Description
2009-10-13 Name : SLES10: Security update for nagios plugins
File : nvt/sles10_nagios-plugins.nasl
2009-10-10 Name : SLES9: Security update for nagios plugins
File : nvt/sles9p5018311.nasl
2009-03-23 Name : Ubuntu Update for nagios-plugins vulnerability USN-532-1
File : nvt/gb_ubuntu_USN_532_1.nasl
2009-02-27 Name : Fedora Update for nagios-plugins FEDORA-2007-2713
File : nvt/gb_fedora_2007_2713_nagios-plugins_fc7.nasl
2009-02-27 Name : Fedora Update for nagios-plugins FEDORA-2007-2876
File : nvt/gb_fedora_2007_2876_nagios-plugins_fc8.nasl
2009-02-17 Name : Fedora Update for nagios-plugins FEDORA-2008-3061
File : nvt/gb_fedora_2008_3061_nagios-plugins_fc8.nasl
2009-02-17 Name : Fedora Update for nagios FEDORA-2008-3098
File : nvt/gb_fedora_2008_3098_nagios_fc8.nasl
2009-02-17 Name : Fedora Update for nagios-plugins FEDORA-2008-3146
File : nvt/gb_fedora_2008_3146_nagios-plugins_fc7.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200711-11 (nagios-plugins)
File : nvt/glsa_200711_11.nasl
2008-09-04 Name : FreeBSD Ports: nagios-plugins
File : nvt/freebsd_nagios-plugins.nasl
2008-02-28 Name : Debian Security Advisory DSA 1495-2 (nagios-plugins)
File : nvt/deb_1495_2.nasl
2008-02-15 Name : Debian Security Advisory DSA 1495-1 (nagios-plugins)
File : nvt/deb_1495_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
41639 Nagios Plugins check_http.c redir Function Location Header Response Overflow

A remote overflow exists in Nagios Plugins. Nagios Plugins fails to check for a boundary in check_http.c in the redir function caused by an overly long HTTP location header response resulting in a buffer overflow. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.
40391 Nagios Plugins check_snmp Function Crafted snmpget Reply Remote DoS

Nessus® Vulnerability Scanner

Date Description
2009-09-24 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_11953.nasl - Type : ACT_GATHER_INFO
2008-04-18 Name : The remote Fedora host is missing a security update.
File : fedora_2008-3061.nasl - Type : ACT_GATHER_INFO
2008-04-18 Name : The remote Fedora host is missing a security update.
File : fedora_2008-3098.nasl - Type : ACT_GATHER_INFO
2008-04-18 Name : The remote Fedora host is missing a security update.
File : fedora_2008-3146.nasl - Type : ACT_GATHER_INFO
2008-02-14 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1495.nasl - Type : ACT_GATHER_INFO
2007-12-13 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_nagios-plugins-4624.nasl - Type : ACT_GATHER_INFO
2007-11-29 Name : The remote openSUSE host is missing a security update.
File : suse_nagios-plugins-4621.nasl - Type : ACT_GATHER_INFO
2007-11-10 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-532-1.nasl - Type : ACT_GATHER_INFO
2007-11-09 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200711-11.nasl - Type : ACT_GATHER_INFO
2007-11-07 Name : The remote Fedora host is missing a security update.
File : fedora_2007-2876.nasl - Type : ACT_GATHER_INFO
2007-11-06 Name : The remote Fedora host is missing a security update.
File : fedora_2007-2713.nasl - Type : ACT_GATHER_INFO
2007-10-15 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_7453c85d783011dcb4c80016179b2dd5.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:35:17
  • Multiple Updates