[USN-698-1] Nagios vulnerability
Subject: [USN-698-1] Nagios vulnerability
From: Marc Deslauriers <marc.deslauriers@canonical.com.>
To: ubuntu-security-announce@lists.ubuntu.com
X-Original-To: marc.deslauriers@cleanmail.canonical.com
X-Mailcontrol-Inbound: uq3drnD2P+ps5SfEb0fvr78+NoP1DHBZwGqKpaXB2eTgNv8D6KLIxb8+NoP1DHBZ8VSaBg0k0xw=
X-Spam-Score: -4.2
X-Scanned-By: MailControl A_08_51_00 (www.mailcontrol.com) on 10.74.0.149
Date: Mon, 22 Dec 2008 09:35:54 -0500
Message-Id: <1229956554.23276.8.camel@mdlinux.technorage.com.>
Mime-Version: 1.0
X-Mailer: Evolution 2.24.2
X-Mailman-Approved-At: Mon, 22 Dec 2008 14:38:54 +0000
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
X-BeenThere: ubuntu-security-announce@lists.ubuntu.com
X-Mailman-Version: 2.1.8
Reply-To: ubuntu-users@lists.ubuntu.com
Content-Type: multipart/mixed; boundary="===============7593390678581637214=="
Mime-version: 1.0
Sender: ubuntu-security-announce-bounces@lists.ubuntu.com
Errors-To: ubuntu-security-announce-bounces@lists.ubuntu.com
X-Virus-Scanned: antivirus-gw at tyumen.ru
--===============7593390678581637214==
Content-Type: multipart/signed; micalg="pgp-sha1"; protocol="application/pgp-signature"; boundary="=-8LLLPFZXuFgeDvsoXmCd"
--=-8LLLPFZXuFgeDvsoXmCd
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
Ubuntu Security Notice USN-698-1 December 22, 2008
nagios vulnerability
CVE-2008-5027
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 6.06 LTS:
nagios-common 2:1.3-cvs.20050402-8ubuntu8
After a standard system upgrade you need to restart Nagios to effect
the necessary changes.
Details follow:
It was discovered that Nagios did not properly parse commands submitted usi=
ng
the web interface. An authenticated user could use a custom form or a brows=
er
addon to bypass security restrictions and submit unauthorized commands.
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios_1.3-cvs.200=
50402-8ubuntu8.diff.gz
Size/MD5: 70914 96d8036bdb33aadd3141715039c91b24
http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios_1.3-cvs.200=
50402-8ubuntu8.dsc
Size/MD5: 959 0393336015bf452f5dfeb74d75245311
http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios_1.3-cvs.200=
50402.orig.tar.gz
Size/MD5: 1621251 0f92b7b8e705411b7881d3650cbb5d56
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-common_1.3-=
cvs.20050402-8ubuntu8_all.deb
Size/MD5: 1218132 d18e298ee16f4c6c6b7c5969c46044e6
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3-c=
vs.20050402-8ubuntu8_amd64.deb
Size/MD5: 1030206 085483fdefd0d7bc43e55dbc5be2bcd6
http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3-c=
vs.20050402-8ubuntu8_amd64.deb
Size/MD5: 1041656 09fc7bb2ff11062603680d09e290909b
http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-cv=
s.20050402-8ubuntu8_amd64.deb
Size/MD5: 1025618 61619d13effd9a4970486abf5933c756
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3-c=
vs.20050402-8ubuntu8_i386.deb
Size/MD5: 877846 544afaebec24e7e94d2ce1da3a89346c
http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3-c=
vs.20050402-8ubuntu8_i386.deb
Size/MD5: 886544 411d3ca5a204aa41a4a42ef6e5f56453
http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-cv=
s.20050402-8ubuntu8_i386.deb
Size/MD5: 872936 aa31f6d1fb8a081a206eae3d6bfb3dd6
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3-c=
vs.20050402-8ubuntu8_powerpc.deb
Size/MD5: 1015630 540a27062c7f8612b7f460b2bcfd93b9
http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3-c=
vs.20050402-8ubuntu8_powerpc.deb
Size/MD5: 1024374 47e0480006df0b20a83f67b56da7a9f8
http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-cv=
s.20050402-8ubuntu8_powerpc.deb
Size/MD5: 993324 03a67a7675075050a672a4c515e8e0c3
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-mysql_1.3-c=
vs.20050402-8ubuntu8_sparc.deb
Size/MD5: 918810 7340348f043dd884c88bd016ee30e41d
http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-pgsql_1.3-c=
vs.20050402-8ubuntu8_sparc.deb
Size/MD5: 926172 e9ccf388b828a17e868807aa39cb5b51
http://security.ubuntu.com/ubuntu/pool/main/n/nagios/nagios-text_1.3-cv=
s.20050402-8ubuntu8_sparc.deb
Size/MD5: 917374 c88dec0d93f590f8a93ebbc701696f68
--=-8LLLPFZXuFgeDvsoXmCd
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEABECAAYFAklPpccACgkQLMAs/0C4zNpo0QCgj3got0/fA54JEE3r7V0OKpcd
pnMAni9+CEXeT1lKpcrf+kG2OkubVK8R
=ayx5
-----END PGP SIGNATURE-----
--=-8LLLPFZXuFgeDvsoXmCd--
--===============7593390678581637214==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============7593390678581637214==--
