oss-security - CVE request: Nagios (two issues)

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Thu, 06 Nov 2008 17:34:06 +0100
From: Andreas Ericsson <ae@....se>
To: oss-security@...ts.openwall.com
CC: Johannes Dagemark <jd@....se>, Ethan Galstad <egalstad@...ios.org>, 
 "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE request: Nagios (two issues)

We need two CVE id's for the Nagios project.

******

1.
Low-privileged users can create a custom form (or use a browser
addon) to bypass authorization and submit commands to the nagios
process that causes other programs to be run with the privileges
of the Nagios process.
Fixed in Nagios 3.0.5.

******

2.
Cross-Site Request Forgery allows remote attackers to submit
commands to the nagios process, thereby causing programs to run
on the Nagios server with the privileges of the Nagios process.
Patch available at
http://git.op5.org/git/?p=nagios.git;a=commit;h=814d8d4d1a73f7151eeed187c0667585d79fea18

******

TIA.

-- 
Andreas Ericsson                   andreas.ericsson@....se
OP5 AB                             www.op5.se
Tel: +46 8-230225                  Fax: +46 8-230231

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.