PT-2013-1886 · Nagios+3 · Nagios Core+3

Blasty

+3

·

Publicado

2013-01-22

·

Atualizado

2017-09-28

·

CVE-2012-6096

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Nagios Core versions prior to 3.4.4 Icinga versions 1.6.x prior to 1.6.2 Icinga versions 1.7.x prior to 1.7.4 Icinga versions 1.8.x prior to 1.8.4
Description The issue is related to multiple stack-based buffer overflows in the get history function in history.cgi. This might allow remote attackers to execute arbitrary code via a long host name variable (host parameter) or svc description variable.
Recommendations For Nagios Core versions prior to 3.4.4, update to version 3.4.4 or later. For Icinga versions 1.6.x prior to 1.6.2, update to version 1.6.2 or later. For Icinga versions 1.7.x prior to 1.7.4, update to version 1.7.4 or later. For Icinga versions 1.8.x prior to 1.8.4, update to version 1.8.4 or later.

Exploit

Correção

RCE

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2017-2354
CVE-2012-6096
DSA-2616-1
DSA-2653-1
SUSE-SU-2013_0358-1

Produtos afetados

Alt Linux
Icinga
Nagios Core
Suse