PT-2003-1125 · Tildeslash · Monit

Evgeny Legerov · Published 2003-11-24 · Updated 2017-07-11 · CVE-2003-1084

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Monit versions 1.4 through 4.1

Description The issue allows remote attackers to cause a denial of service, potentially leading to a daemon crash, via an HTTP POST request with a negative Content-Length field. Multiple vulnerabilities in the Monit package can lead to breaches of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For Monit versions 1.4 through 4.1, consider disabling HTTP POST requests until a patch is available. Restrict access to the Monit daemon to minimize the risk of exploitation. Avoid using negative values for the Content-Length field in HTTP POST requests to the Monit daemon until the issue is resolved.

Exploit

Fix

Related Identifiers

BDU:2015-09446

CVE-2003-1084

Affected Products

Monit

References · 12

• 🔥 http://securityfocus.com/archive/1/345417 · Exploit
• http://tildeslash.com/monit/dist/CHANGES.txt · Vendor Advisory
• http://securityfocus.com/bid/9098 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-1084 · Security Note
• http://security.gentoo.org/glsa/glsa-200403-14.xml · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-1084 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-1084 · Vendor Advisory
• http://secunia.com/advisories/10280 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09446 · Security Note
• https://osv.dev/vulnerability/CVE-2003-1084 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13818 · Note
• http://kb.cert.org/vuls/id/206382 · Note