Published: 01/07/2009 Updated: 03/04/2010

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 765

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

statuswml.cgi in Nagios prior to 3.1.1 allows remote malicious users to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.

Vulnerable Product	Search on Vulmon	Subscribe to Product
nagios nagios 2.0b4
nagios nagios 2.10
nagios nagios 3.0.3
nagios nagios 3.0.2
nagios nagios 3.0
nagios nagios 1.0b4
nagios nagios 1.1
nagios nagios 1.4.1
nagios nagios 2.0
nagios nagios 3.0.6
nagios nagios 3.0.4
nagios nagios
nagios nagios 1.0
nagios nagios 1.0b1
nagios nagios 1.0b2
nagios nagios 2.7
nagios nagios 3.0.5
nagios nagios 3.0.1

It was discovered that Nagios did not properly parse certain commands submitted using the WAP web interface An authenticated user could exploit this flaw and execute arbitrary programs on the server ...

It was discovered that the statuswmlcgi script of nagios, a monitoring and management system for hosts, services and networks, is prone to a command injection vulnerability Input to the ping and traceroute parameters of the script is not properly validated which allows an attacker to execute arbitrary shell commands by passing a crafted value to ...

## # $Id$ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote include Ms ...

source: wwwsecurityfocuscom/bid/35464/info Nagios is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data Remote attackers can exploit this issue to execute arbitrary shell commands with the privileges of the user running the application NOTE: For an exploit to succeed, acc ...

## # $Id: nagios3_statuswml_pingrb 9829 2010-07-14 18:23:47Z hdm $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## require 'msf/core' c ...

CWE-78 http://www.nagios.org/development/history/core-3x/http://secunia.com/advisories/35543 http://tracker.nagios.org/view.php?id=15 http://secunia.com/advisories/35688 http://www.debian.org/security/2009/dsa-1825 http://secunia.com/advisories/35692 http://www.ubuntu.com/usn/USN-795-1 http://www.securitytracker.com/id?1022503 http://security.gentoo.org/glsa/glsa-200907-15.xml http://www.vupen.com/english/advisories/2010/0750 http://secunia.com/advisories/39227 http://marc.info/?l=bugtraq&m=126996888626964&w=2 https://usn.ubuntu.com/795-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/9861/

CVE-2009-2288

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect