PT-2016-1726 · Xymon+1 · Xymon+1

Jccleaver · Published 2016-02-26 · Updated 2018-10-09 · CVE-2016-2057

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Xymon versions 4.1.x through 4.3.x before 4.3.25

Description The issue is related to insufficient access control in the lib/xymond ipc.c component of the Xymon network monitoring tool. This allows a local attacker to inject arbitrary messages into the queue by writing to it.

Recommendations For versions 4.1.x through 4.3.x before 4.3.25, update to version 4.3.25 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2016-1161

BDU:2016-01052

CVE-2016-2057

DSA-3495-1

MGASA-2016-0177

Affected Products

Alt Linux

Xymon

References · 20

• https://cve.org/CVERecord?id=CVE-2016-2057 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2057 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-2057 · Vendor Advisory
• http://debian.org/security/2016/dsa-3495 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01052 · Security Note
• https://sourceforge.net/p/xymon/code/7891 · Patch
• https://ubuntu.com/security/CVE-2016-2057 · Vendor Advisory
• https://debian.org/security/2016/dsa-3495 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-2057 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2057 · Security Note
• https://osv.dev/vulnerability/MGASA-2016-0177 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-2057 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3495-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0177.html · Security Note
• http://packetstormsecurity.com/files/135758/Xymon-4.3.x-Buffer-Overflow-Code-Execution-Information-Disclosure.html · Note