Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <qTqdb/DhtqaUyAElWqW12r9XT/k@DnrfhFPe1KmBT9SMnrHVxzpiU9A>
Date: Mon, 8 Dec 2008 15:57:46 +0300
From: Eygene Ryabinkin <rea-sec@...elabs.ru>
To: oss-security@...ts.openwall.com, jlieskov@...hat.com
Cc: coley@...re.org
Subject: Re: CVE Request (nagios)

Jan, good day.

Mon, Dec 08, 2008 at 01:21:45PM +0100, Jan Lieskovsky wrote:
>   diffing your version (3.0.5p1) and the latest upstream one (3.0.6)
> returns the following (this commit was posted on 2008-11-30):
> 
> diff
> -r /tmp/3.0.5p1/nagios-3.0.5p1/base/commands.c /tmp/nagios_latest/nagios-3.0.6/base/commands.c
[...]
> 2893a2896,2908
> > 
> >       /* SECURITY PATCH - disable these for the time being */
> >       switch(cmd){
> >       case CMD_CHANGE_GLOBAL_HOST_EVENT_HANDLER:
> >       case CMD_CHANGE_GLOBAL_SVC_EVENT_HANDLER:
> >       case CMD_CHANGE_HOST_EVENT_HANDLER:
> >       case CMD_CHANGE_SVC_EVENT_HANDLER:
> >       case CMD_CHANGE_HOST_CHECK_COMMAND:
> >       case CMD_CHANGE_SVC_CHECK_COMMAND:
> >               return ERROR;
> >               }
>
> And other vulnerability reports:
> http://www.nagios.org/news/#88
> http://secunia.com/Advisories/32909/
> 
> Andreas, could you please confirm/disprove this patch was part of recent
> CVE-2008-{5027, 5028}? 
> 
> Seems it wasn't, but can be wrong.

Hmm, this seems to be unrelated to CVE-2008-5027, but it may be the
upstream fix for CSRF: judging by the contents of
  http://git.op5.org/git/?p=nagios.git;a=commitdiff;h=9c2a418ab4f6e4ef3a53ddcde402fe4781caa764
the original patch from Tim Starling should introduce at least 'csrf' word
into cgi/cmd.c.  And I am failing to find one in the latest version,
  http://nagios.cvs.sourceforge.net/viewvc/nagios/nagios/cgi/cmd.c?revision=1.47&view=markup

So either it was fixed in the completely different way or it is the
quick fix to prevent CSRFs for the eventhandler mangling commands.  It
is a bit strange that it was done after 3.0.5 (CSRF was documented in
3.0.5 release notes), but...  By the way, entry for CVE-2008-5028 speaks
about 3.0.5 as about the vulnerable to the CSRF and it is inconsistent
with the release notes at
  http://www.nagios.org/development/history/nagios-3x.php.

Clarifications are desperately needed ;))
-- 
Eygene

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.