PT-2019-4943 · Monit+2 · Monit+2

Zack Flack · Published 2019-03-04 · Updated 2022-03-31 · CVE-2019-11455

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Monit versions prior to 5.25.3

Description The issue is related to a buffer over-read in the Util urlDecode function of the Monit utility, which can lead to a denial of service. An attacker can exploit this by manipulating GET or POST parameters, potentially allowing them to retrieve adjacent memory contents or cause an application outage.

Recommendations For Monit versions prior to 5.25.3, update to version 5.25.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Util urlDecode function or limiting the manipulation of GET and POST parameters to minimize the risk of exploitation.

Exploit

Fix

DoS

Buffer Overflow

Out of bounds Read

Weakness Enumeration

CWE-119

CWE-125

Related Identifiers

ALT-PU-2019-1373

BDU:2020-01555

CVE-2019-11455

DLA-1767-1

DLA-2855-1

MGASA-2019-0246

USN-3971-1

USN-4860-1

Affected Products

Alt Linux

Monit

Ubuntu

References · 39

• 🔥 https://github.com/dzflack/exploits/blob/master/unix/monit_buffer_overread.py · Exploit
• 🔥 https://github.com/dzflack/exploits/blob/master/unix/monit_xss.py · Exploit
• 🔥 https://github.com/dzflack/exploits/blob/master/macos/monit_dos.py · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11455 · Security Note
• https://bdu.fstec.ru/vul/2020-01555 · Security Note
• https://security-tracker.debian.org/tracker/DLA-1767-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZQDHRSKTEX5MSYXNCGFTUSFGANBARHX · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-11455 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0246 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L475QJMFFI2QV5QEHAKKPVX6QX6ECUL6 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11455 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2019-1373 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1767-1 · Vendor Advisory
• https://bitbucket.org/tildeslash/monit/commits/f12d0cdb42d4e74dffe1525d4062c815c48ac57a · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11455 · Vendor Advisory