PT-2003-1125 · Tildeslash · Monit

Evgeny Legerov · Publicado 2003-11-24 · Atualizado 2017-07-11 · CVE-2003-1084

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Monit versions 1.4 through 4.1

Description The issue allows remote attackers to cause a denial of service, potentially leading to a daemon crash, via an HTTP POST request with a negative Content-Length field. Multiple vulnerabilities in the Monit package can lead to breaches of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For Monit versions 1.4 through 4.1, consider disabling HTTP POST requests until a patch is available. Restrict access to the Monit daemon to minimize the risk of exploitation. Avoid using negative values for the Content-Length field in HTTP POST requests to the Monit daemon until the issue is resolved.

Exploit

Correção

Identificadores relacionados

BDU:2015-09446

CVE-2003-1084

Produtos afetados

Monit

Referências · 12

• 🔥 http://securityfocus.com/archive/1/345417 · Exploit
• http://tildeslash.com/monit/dist/CHANGES.txt · Aviso do Fabricante
• http://securityfocus.com/bid/9098 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13818 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-1084 · Nota de Segurança
• http://security.gentoo.org/glsa/glsa-200403-14.xml · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2003-1084 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-1084 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/206382 · Nota
• http://secunia.com/advisories/10280 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-09446 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2003-1084 · Aviso do Fabricante