PT-2008-6185 · Op5+1 · Op5 Monitor+1

Publicado 2008-11-10 · Atualizado 2017-08-08 · CVE-2008-5028

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Nagios version 3.0.5 op5 Monitor versions prior to 4.0.1

Description A cross-site request forgery (CSRF) issue exists in cmd.cgi, allowing remote attackers to send commands to the Nagios process and trigger the execution of arbitrary programs via unspecified HTTP requests.

Recommendations For Nagios version 3.0.5, update to a version later than 3.0.5 to resolve the issue. For op5 Monitor versions prior to 4.0.1, update to version 4.0.1 or later to fix the problem.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2008-5028

Produtos afetados

Nagios

Op5 Monitor

Referências · 19

• http://marc.info/?l=bugtraq&m=124156641928637&w=2 · Aviso do Fabricante
• http://osvdb.org/49678 · Nota
• http://secunia.com/advisories/32630 · Nota
• http://security.gentoo.org/glsa/glsa-200907-15.xml · Aviso do Fabricante
• http://securitytracker.com/id?1022165 · Nota
• http://secunia.com/advisories/35002 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46426 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5028 · Nota
• http://secunia.com/advisories/32610 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2008/11/06/2 · Nota
• http://op5.com/support/news/389-important-security-fix-available-for-op5-monitor · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/1256 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5028 · Nota de Segurança
• http://vupen.com/english/advisories/2008/3029 · Nota
• https://ubuntu.com/usn/USN-698-3 · Aviso do Fabricante