oss-security - nagios: remote code execution

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Mon, 29 Jun 2009 13:23:23 +0200
From: Tomas Hoger <thoger@...hat.com>
To: OSS Security <oss-security@...ts.openwall.com>
Subject: nagios: remote code execution

Hi!

Just in case you missed it - nagios 3.1.1 mentions:

# Security fix for statuswml.cgi where arbitrary shell injection was
possible 

( http://www.nagios.org/development/history/core-3x/ )

Further details in the upstream bug:

  http://tracker.nagios.org/view.php?id=15

-- 
Tomas Hoger / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.