PT-2014-1780 · Icinga · Icinga

Ricardo · Published 2014-01-14 · Updated 2014-02-25 · CVE-2013-7106

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Icinga versions prior to 1.8.5 Icinga versions prior to 1.9.4 Icinga versions prior to 1.10.2

Description The issue allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a long string to certain functions, including display nav table, page limit selector, print export link, page num selector, status page num selector, and display command expansion. It can also be exploited without authentication by leveraging another vulnerability.

Recommendations For Icinga versions prior to 1.8.5, update to version 1.8.5 or later. For Icinga versions prior to 1.9.4, update to version 1.9.4 or later. For Icinga versions prior to 1.10.2, update to version 1.10.2 or later. As a temporary workaround, consider restricting access to the cgi/cgiutils.c, cgi/status.c, and cgi/config.c files until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-03479

CVE-2013-7106

DSA-2956-1

Affected Products

Icinga

References · 14

• https://osv.dev/vulnerability/UBUNTU-CVE-2013-7106 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-7106 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7107 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7106 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1878 · Security Note
• https://cve.org/CVERecord?id=CVE-2013-7106 · Security Note
• https://ubuntu.com/security/CVE-2013-7106 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7108 · Security Note
• https://icinga.org/2013/12/17/icinga-security-releases-1-10-2-1-9-4-1-8-5 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03479 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2386 · Security Note
• http://openwall.com/lists/oss-security/2013/12/16/4 · Note
• https://dev.icinga.org/issues/5250 · Note
• http://debian.org/security/dsa-2956 · Note