PT-2014-1781 · Icinga · Icinga

Ricardo · Published 2014-01-14 · Updated 2014-03-06 · CVE-2013-7107

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Icinga versions 1.8.5 and earlier Icinga versions 1.9.4 and earlier Icinga versions 1.10.2 and earlier

Description A cross-site request forgery (CSRF) issue in cmd.cgi allows remote attackers to hijack user authentication for unspecified commands. This can be exploited via unspecified vectors. The vulnerability may lead to disruption of confidentiality, integrity, and availability of protected information. Exploitation can be done remotely.

Recommendations For Icinga version 1.8.5 and earlier, update to a version that fixes the CSRF vulnerability in cmd.cgi. For Icinga version 1.9.4 and earlier, update to a version that fixes the CSRF vulnerability in cmd.cgi. For Icinga version 1.10.2 and earlier, update to a version that fixes the CSRF vulnerability in cmd.cgi. As a temporary workaround, consider restricting access to cmd.cgi to minimize the risk of exploitation.

Fix

Buffer Overflow

CSRF

Weakness Enumeration

CWE-119

CWE-352

Related Identifiers

BDU:2015-03479

CVE-2013-7107

DSA-2956-1

OPENSUSE-SU-2024:10182-1

Affected Products

Icinga

References · 14

• http://lists.opensuse.org/opensuse-updates/2014-02/msg00061.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7107 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7106 · Security Note
• https://dev.icinga.org/issues/5250 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-7107 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1878 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-7107 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7108 · Security Note
• https://icinga.org/2013/12/17/icinga-security-releases-1-10-2-1-9-4-1-8-5 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03479 · Security Note
• https://dev.icinga.org/issues/5346 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2386 · Security Note
• http://openwall.com/lists/oss-security/2013/12/16/4 · Note
• http://debian.org/security/dsa-2956 · Note