PT-2008-6185 · Op5+1 · Op5 Monitor+1

Published 2008-11-10 · Updated 2017-08-08 · CVE-2008-5028

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Nagios version 3.0.5 op5 Monitor versions prior to 4.0.1

Description A cross-site request forgery (CSRF) issue exists in cmd.cgi, allowing remote attackers to send commands to the Nagios process and trigger the execution of arbitrary programs via unspecified HTTP requests.

Recommendations For Nagios version 3.0.5, update to a version later than 3.0.5 to resolve the issue. For op5 Monitor versions prior to 4.0.1, update to version 4.0.1 or later to fix the problem.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-5028

Affected Products

Nagios

Op5 Monitor

References · 19

• http://marc.info/?l=bugtraq&m=124156641928637&w=2 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200907-15.xml · Vendor Advisory
• http://secunia.com/advisories/32610 · Vendor Advisory
• http://op5.com/support/news/389-important-security-fix-available-for-op5-monitor · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5028 · Security Note
• https://ubuntu.com/usn/USN-698-3 · Vendor Advisory
• http://sourceforge.net/mailarchive/forum.php?thread_name=4914396D.5010009%40op5.se&forum_name=nagios-devel · Patch
• http://osvdb.org/49678 · Note
• http://secunia.com/advisories/32630 · Note
• http://securitytracker.com/id?1022165 · Note
• http://secunia.com/advisories/35002 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46426 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5028 · Note
• http://openwall.com/lists/oss-security/2008/11/06/2 · Note
• http://vupen.com/english/advisories/2009/1256 · Note