|
Message-ID: <qTqdb/DhtqaUyAElWqW12r9XT/k@DnrfhFPe1KmBT9SMnrHVxzpiU9A> Date: Mon, 8 Dec 2008 15:57:46 +0300 From: Eygene Ryabinkin <rea-sec@...elabs.ru> To: oss-security@...ts.openwall.com, jlieskov@...hat.com Cc: coley@...re.org Subject: Re: CVE Request (nagios) Jan, good day. Mon, Dec 08, 2008 at 01:21:45PM +0100, Jan Lieskovsky wrote: > diffing your version (3.0.5p1) and the latest upstream one (3.0.6) > returns the following (this commit was posted on 2008-11-30): > > diff > -r /tmp/3.0.5p1/nagios-3.0.5p1/base/commands.c /tmp/nagios_latest/nagios-3.0.6/base/commands.c [...] > 2893a2896,2908 > > > > /* SECURITY PATCH - disable these for the time being */ > > switch(cmd){ > > case CMD_CHANGE_GLOBAL_HOST_EVENT_HANDLER: > > case CMD_CHANGE_GLOBAL_SVC_EVENT_HANDLER: > > case CMD_CHANGE_HOST_EVENT_HANDLER: > > case CMD_CHANGE_SVC_EVENT_HANDLER: > > case CMD_CHANGE_HOST_CHECK_COMMAND: > > case CMD_CHANGE_SVC_CHECK_COMMAND: > > return ERROR; > > } > > And other vulnerability reports: > http://www.nagios.org/news/#88 > http://secunia.com/Advisories/32909/ > > Andreas, could you please confirm/disprove this patch was part of recent > CVE-2008-{5027, 5028}? > > Seems it wasn't, but can be wrong. Hmm, this seems to be unrelated to CVE-2008-5027, but it may be the upstream fix for CSRF: judging by the contents of http://git.op5.org/git/?p=nagios.git;a=commitdiff;h=9c2a418ab4f6e4ef3a53ddcde402fe4781caa764 the original patch from Tim Starling should introduce at least 'csrf' word into cgi/cmd.c. And I am failing to find one in the latest version, http://nagios.cvs.sourceforge.net/viewvc/nagios/nagios/cgi/cmd.c?revision=1.47&view=markup So either it was fixed in the completely different way or it is the quick fix to prevent CSRFs for the eventhandler mangling commands. It is a bit strange that it was done after 3.0.5 (CSRF was documented in 3.0.5 release notes), but... By the way, entry for CVE-2008-5028 speaks about 3.0.5 as about the vulnerable to the CSRF and it is inconsistent with the release notes at http://www.nagios.org/development/history/nagios-3x.php. Clarifications are desperately needed ;)) -- Eygene
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.