PT-2012-4714 · Icinga · Icinga

Lars Vogdt · Published 2012-08-25 · Updated 2017-08-29 · CVE-2012-3441

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Icinga version 1.7.1

Description The issue in Icinga allows the icinga user to access all databases due to the database creation script granting excessive access. This could potentially be exploited via unspecified vectors, allowing icinga users to access other databases.

Recommendations For Icinga version 1.7.1, consider restricting the access rights of the icinga user to prevent unauthorized access to other databases. As a temporary workaround, review and modify the database creation script (module/idoutils/db/scripts/create mysqldb.sh) to ensure it grants the least privileges necessary for the icinga user.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-3441

Affected Products

Icinga

References · 12

• 🔥 https://git.icinga.org/?p=icinga-core.git;a=commitdiff;h=dcd45fb6931c4abf710829bee21af09f842bc281 · Exploit
• 🔥 https://git.icinga.org/?p=icinga-doc.git;a=commitdiff;h=619a08ca1178144b8a3a5caafff32a2d3918edab · Exploit
• 🔥 https://git.icinga.org/?p=icinga-core.git;a=commitdiff;h=712813d3118a5b9e5a496179cab81dbe91f69d63 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-3441 · Security Note
• http://lists.opensuse.org/opensuse-updates/2012-08/msg00012.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2012/07/30/6 · Note
• http://openwall.com/lists/oss-security/2012/07/30/7 · Note
• https://bugzilla.novell.com/show_bug.cgi?id=767319 · Note
• https://git.icinga.org/?p=icinga-doc.git%3Ba=commitdiff%3Bh=619a08ca1178144b8a3a5caafff32a2d3918edab · Note
• https://git.icinga.org/?p=icinga-core.git%3Ba=commitdiff%3Bh=dcd45fb6931c4abf710829bee21af09f842bc281 · Note
• https://git.icinga.org/?p=icinga-core.git%3Ba=commitdiff%3Bh=712813d3118a5b9e5a496179cab81dbe91f69d63 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78874 · Note