USN-3253-1

Dashboard / Vulnerabilities / USN-3253-1

USN-3253-1

Summary: nagios3 vulnerabilities

Details: It was discovered that Nagios incorrectly handled certain long strings. A remote authenticated attacker could use this issue to cause Nagios to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2013-7108, CVE-2013-7205) It was discovered that Nagios incorrectly handled certain long messages to cmd.cgi. A remote attacker could possibly use this issue to cause Nagios to crash, resulting in a denial of service. (CVE-2014-1878) Dawid Golunski discovered that Nagios incorrectly handled symlinks when accessing log files. A local attacker could possibly use this issue to elevate privileges. In the default installation of Ubuntu, this should be prevented by the Yama link restrictions. (CVE-2016-9566)

References: https://ubuntu.com/security/notices/USN-3253-1, https://ubuntu.com/security/CVE-2013-7108, https://ubuntu.com/security/CVE-2013-7205, https://ubuntu.com/security/CVE-2014-1878, https://ubuntu.com/security/CVE-2016-9566