USN-698-2: Nagios3 vulnerabilities Post: 302270620

Sponsored Content

Special Forums Cybersecurity Security Advisories (RSS) USN-698-2: Nagios3 vulnerabilities Post 302270620 by Linux Bot on Monday 22nd of December 2008 10:20:03 AM

12-22-2008

Registered User

USN-698-2: Nagios3 vulnerabilities

Referenced CVEs:
CVE-2008-5027, CVE-2008-5028

Description:
=========================================================== Ubuntu Security Notice USN-698-2 December 22, 2008 nagios3 vulnerabilities CVE-2008-5027, CVE-2008-5028 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 8.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 8.10: nagios3 3.0.2-1ubuntu1.1 After a standard system upgrade you need to restart Nagios to effect the necessary changes. Details follow: It was discovered that Nagios was vulnerable to a Cross-site request forgery (CSRF) vulnerability. If an authenticated nagios user were tricked into clicking a link on a specially crafted web page, an attacker could trigger commands to be processed by Nagios and execute arbitrary programs. This update alters Nagios behaviour by disabling submission of CMD_CHANGE commands. (CVE-2008-5028) It was discovered that Nagios did not properly parse commands submitted using the web interface. An authenticated user could use a custom form or a browser addon to bypass security restrictions and submit unauthorized commands. (CVE-2008-5027)

More...

Linux Bot

View Public Profile for Linux Bot

Find all posts by Linux Bot

LEARN ABOUT DEBIAN

nagios3

nagios3(8)							      nagios								nagios3(8)

NAME

       nagios3 - network/systems status monitoring daemon

SYNOPSIS

       nagios3 [-h] [-v] [-s] [-d] <main_config_file>

DESCRIPTION

       nagios3	is  a  daemon  program	that  monitors the status of various network accessible systems, devices, and more.  For more information,
       please consult the online documentation available at http://www.nagios.org, or on your nagios server's web page.

OPTIONS

       main_config_file
	      The main configuration file.  On debian systems this defaults to /etc/nagios3/nagios.cfg

       -h     A helpful usage message

       -v     Reads all data in the configuration files and performs a basic verification/sanity check.  Always make sure you verify  your  config
	      data before (re)starting Nagios.

       -s     Shows projected/recommended check scheduling information based on the current data in the configuration files.

       -d     Starts Nagios in daemon mode (instead of as a foreground process).

FILES

       /etc/nagios3
	      Default configuration directory for nagios3

AUTHOR

       nagios3	is  written and maintained by Ethan Galstad <nagios@nagios.org>.  This manual page was written by sean finney <seanius@debian.org>
       for the Debian GNU/Linux operating system (but it may be freely used, modified, and redistributed by others).

sean finney							   February 2006							nagios3(8)