PT-2014-1781 · Icinga · Icinga

Ricardo · Publicado 2014-01-14 · Atualizado 2014-03-06 · CVE-2013-7107

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Icinga versions 1.8.5 and earlier Icinga versions 1.9.4 and earlier Icinga versions 1.10.2 and earlier

Description A cross-site request forgery (CSRF) issue in cmd.cgi allows remote attackers to hijack user authentication for unspecified commands. This can be exploited via unspecified vectors. The vulnerability may lead to disruption of confidentiality, integrity, and availability of protected information. Exploitation can be done remotely.

Recommendations For Icinga version 1.8.5 and earlier, update to a version that fixes the CSRF vulnerability in cmd.cgi. For Icinga version 1.9.4 and earlier, update to a version that fixes the CSRF vulnerability in cmd.cgi. For Icinga version 1.10.2 and earlier, update to a version that fixes the CSRF vulnerability in cmd.cgi. As a temporary workaround, consider restricting access to cmd.cgi to minimize the risk of exploitation.

Correção

Buffer Overflow

CSRF

Enumeração de Fraquezas

CWE-119

CWE-352

Identificadores relacionados

BDU:2015-03479

CVE-2013-7107

DSA-2956-1

OPENSUSE-SU-2024:10182-1

Produtos afetados

Icinga

Referências · 14

• http://lists.opensuse.org/opensuse-updates/2014-02/msg00061.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/12/16/4 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7107 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7106 · Nota de Segurança
• https://dev.icinga.org/issues/5250 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2013-7107 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1878 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2013-7107 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7108 · Nota de Segurança
• https://icinga.org/2013/12/17/icinga-security-releases-1-10-2-1-9-4-1-8-5 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-03479 · Nota de Segurança
• https://dev.icinga.org/issues/5346 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2386 · Nota de Segurança
• http://debian.org/security/dsa-2956 · Nota