PT-2006-3437 · Nagios · Nagios

Sebastian Krahmer · Published 2006-05-19 · Updated 2018-10-03 · CVE-2006-2489

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Nagios versions 1.x before 1.4.1 Nagios versions 2.x before 2.3.1

Description The issue is related to an integer overflow in CGI scripts, which can be triggered by a remote attacker using a crafted Content-Length HTTP header. This could lead to a denial of service (crash) and potentially allow the execution of arbitrary code.

Recommendations For Nagios versions 1.x before 1.4.1, update to version 1.4.1 or later to resolve the issue. For Nagios versions 2.x before 2.3.1, update to version 2.3.1 or later to resolve the issue.

Fix

Related Identifiers

CVE-2006-2489

DSA-1072-1

Affected Products

Nagios

References · 11

• http://secunia.com/advisories/20123 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200605-07.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2489 · Security Note
• http://debian.org/security/2006/dsa-1072 · Vendor Advisory
• https://usn.ubuntu.com/287-1 · Vendor Advisory
• http://nagios.org/development/changelog.php · Note
• http://securityfocus.com/bid/18059 · Note
• http://secunia.com/advisories/20313 · Note
• http://secunia.com/advisories/20247 · Note
• http://vupen.com/english/advisories/2006/1822 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26454 · Note