PT-2014-1782 · Icinga+3 · Icinga+3

Published 2014-01-14 · Updated 2024-06-15 · CVE-2013-7108

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Icinga versions prior to 1.8.5 Icinga versions 1.9 prior to 1.9.4 Icinga versions 1.10 prior to 1.10.2

Description The issue is related to multiple off-by-one errors in the Icinga package, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. This can lead to obtaining sensitive information from process memory or causing a denial of service (crash) via a long string in the last key value in the variable list to the process cgivars function in various files within the cgi/ directory, triggering a heap-based buffer over-read.

Recommendations For Icinga versions prior to 1.8.5, update to version 1.8.5 or later. For Icinga versions 1.9 prior to 1.9.4, update to version 1.9.4 or later. For Icinga versions 1.10 prior to 1.10.2, update to version 1.10.2 or later.

Exploit

Fix

DoS

RCE

Buffer Overflow

Weakness Enumeration

CWE-20

CWE-119

Related Identifiers

ALT-PU-2017-2354

BDU:2015-03479

CVE-2013-7108

DLA-1615-1

DLA-60-1

DSA-2956-1

MGASA-2014-0010

OPENSUSE-SU-2024:11073-1

SUSE-SU-2014_0156-1

USN-3253-1

USN-3253-2

Affected Products

Alt Linux

Icinga

Suse

Ubuntu

References · 85

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/nagios3_history_cgi.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/nagios3_statuswml_ping.rb · Exploit
• 🔥 https://exploit-db.com/exploits/38882 · Exploit
• http://secunia.com/advisories/56316 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7107 · Security Note
• https://osv.dev/vulnerability/DLA-1615-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3253-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-7205 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-7108 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-7108 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7106 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1523 · Security Note
• https://cve.org/CVERecord?id=CVE-2013-7108 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2014:004 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-1615-1 · Vendor Advisory