Published: 10/11/2008 Updated: 08/12/2016

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

VMScore: 578

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

The Nagios process in (1) Nagios prior to 3.0.5 and (2) op5 Monitor prior to 4.0.1 allows remote authenticated users to bypass authorization checks, and trigger execution of arbitrary programs by this process, via an (a) custom form or a (b) browser addon.

Vulnerable Product	Search on Vulmon	Subscribe to Product
nagios nagios 1.0b4
nagios nagios 1.0b3
nagios nagios 1.4
nagios nagios 1.3
nagios nagios 2.0b4
nagios nagios 2.0rc2
nagios nagios 2.5
nagios nagios 2.7
nagios nagios 3.0
op5 monitor 3.3.2
op5 monitor 3.3.1
op5 monitor 2.8
nagios nagios 1.0_b3
nagios nagios 1.0b1
nagios nagios 1.0b2
nagios nagios 1.4.1
nagios nagios 1.2
nagios nagios 1.1
nagios nagios 1.0b6
nagios nagios 2.0rc1
nagios nagios 2.3
nagios nagios 2.8
nagios nagios 2.9
op5 monitor 3.2.4
op5 monitor 3.0.0
nagios nagios 1.0
nagios nagios 1.0b5
nagios nagios 2.0b1
nagios nagios 2.0
nagios nagios 2.0b5
nagios nagios 2.1
nagios nagios 2.3.1
nagios nagios 2.4
nagios nagios 3.0.2
nagios nagios 3.0.1
op5 monitor
op5 monitor 3.3.3
op5 monitor 3.0
op5 monitor 2.4
nagios nagios 1.0_b1
nagios nagios 1.0_b2
nagios nagios 2.0b3
nagios nagios 2.0b2
nagios nagios 2.0b6
nagios nagios 2.2
nagios nagios 2.10
nagios nagios 2.11
nagios nagios
nagios nagios 3.0.3
op5 monitor 2.6
op5 monitor 3.2

It was discovered that Nagios was vulnerable to a Cross-site request forgery (CSRF) vulnerability If an authenticated nagios user were tricked into clicking a link on a specially crafted web page, an attacker could trigger commands to be processed by Nagios and execute arbitrary programs This update alters Nagios behaviour by disabling submission ...

It was discovered that Nagios did not properly parse commands submitted using the web interface An authenticated user could use a custom form or a browser addon to bypass security restrictions and submit unauthorized commands ...

CWE-264 http://www.securityfocus.com/bid/32156 http://sourceforge.net/mailarchive/forum.php?thread_name=4914396D.5010009%40op5.se&forum_name=nagios-devel http://www.openwall.com/lists/oss-security/2008/11/06/2 http://www.nagios.org/development/history/nagios-3x.php http://www.op5.com/support/news/389-important-security-fix-available-for-op5-monitor http://secunia.com/advisories/33320 http://www.ubuntu.com/usn/USN-698-1 http://www.vupen.com/english/advisories/2008/3029 http://www.vupen.com/english/advisories/2009/1256 http://marc.info/?l=bugtraq&m=124156641928637&w=2 http://secunia.com/advisories/35002 http://www.securitytracker.com/id?1022165 http://security.gentoo.org/glsa/glsa-200907-15.xml http://www.vupen.com/english/advisories/2008/3364 https://www.ubuntu.com/usn/USN-698-3/https://nvd.nist.gov https://usn.ubuntu.com/698-3/

CVE-2008-5027

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect