oss-security - Re: CVE Request (nagios)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <bYzcr3rPIUFO2o4fPZ/nQ+xtMqk@keEvuTOlYdAfFUWWrDbTGrfqNd0>
Date: Wed, 10 Dec 2008 16:48:08 +0300
From: Eygene Ryabinkin <rea-sec@...elabs.ru>
To: ae@....se, oss-security@...ts.openwall.com, jlieskov@...hat.com
Cc: coley@...re.org
Subject: Re: CVE Request (nagios)

Andreas, good day.

Will you be able to clarify two things.

Mon, Dec 08, 2008 at 05:19:52PM +0300, Eygene Ryabinkin wrote:
> So
>   http://nagios.cvs.sourceforge.net/viewvc/nagios/nagios/base/commands.c?r1=1.109&r2=1.110&view=patch
> just completely closes the processing of these commands from the
> Nagios side.  May be this was the fix for the case when the evil
> contents from the command file were still floating around but the
> upgraded Nagios won't process them because they could go from the
> previous successful attack but are lying unprocessed?

Do you think it is really so?

> > It is a bit strange that it was done after 3.0.5 (CSRF was documented in
> > 3.0.5 release notes), but...  By the way, entry for CVE-2008-5028 speaks
> > about 3.0.5 as about the vulnerable to the CSRF and it is inconsistent
> > with the release notes at
> >   http://www.nagios.org/development/history/nagios-3x.php.
> 
> So I feel the the CSRF was "somehow closed" in 3.0.5 and CVE entry may
> need fixing.  The remains from this bug that could migrate from 3.0.5 to
> 3.0.6 (but not in the functional sense, only via the unprocessed command
> file) were "fixed" in 3.0.6.

CVE-2008-5028 really speaks about 3.0.5 as about vulnerable to CSRF.  At
least CHANGE_ commands were closed in 3.0.5 and were (presumably)
additionally closed at the Nagios server side in 3.0.6.  So either 3.0.6
is vulnerable too, 3.0.5 is not vulnerable to CSRF or I am missing
something.  What to choose?

Thanks!
-- 
Eygene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.