[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <49131C7E.8050105@op5.se>
Date: Thu, 06 Nov 2008 17:34:06 +0100
From: Andreas Ericsson <ae@....se>
To: oss-security@...ts.openwall.com
CC: Johannes Dagemark <jd@....se>, Ethan Galstad <egalstad@...ios.org>,
"Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE request: Nagios (two issues)
We need two CVE id's for the Nagios project.
******
1.
Low-privileged users can create a custom form (or use a browser
addon) to bypass authorization and submit commands to the nagios
process that causes other programs to be run with the privileges
of the Nagios process.
Fixed in Nagios 3.0.5.
******
2.
Cross-Site Request Forgery allows remote attackers to submit
commands to the nagios process, thereby causing programs to run
on the Nagios server with the privileges of the Nagios process.
Patch available at
http://git.op5.org/git/?p=nagios.git;a=commit;h=814d8d4d1a73f7151eeed187c0667585d79fea18
******
TIA.
--
Andreas Ericsson andreas.ericsson@....se
OP5 AB www.op5.se
Tel: +46 8-230225 Fax: +46 8-230231
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
