Published: 13/04/2016 Updated: 09/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 540

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x prior to 4.3.25 allow remote malicious users to read arbitrary files in the configuration directory via a "config" command.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xymon xymon 4.3.9
xymon xymon 4.3.8
xymon xymon 4.3.23
xymon xymon 4.3.22
xymon xymon 4.3.17
xymon xymon 4.3.16
xymon xymon 4.3.0
xymon xymon 4.2.2
xymon xymon 4.2.0
xymon xymon 4.1.1
xymon xymon 4.1.0
xymon xymon 4.3.5
xymon xymon 4.3.4
xymon xymon 4.3.2
xymon xymon 4.3.19
xymon xymon 4.3.13
xymon xymon 4.3.12
xymon xymon 4.2.3
xymon xymon 4.2
xymon xymon 4.1.2
xymon xymon 4.3.3
xymon xymon 4.3.24
xymon xymon 4.3.18
xymon xymon 4.3.11
xymon xymon 4.3.10
xymon xymon 4.3.1
xymon xymon 4.3.7
xymon xymon 4.3.6
xymon xymon 4.3.21
xymon xymon 4.3.20
xymon xymon 4.3.15
xymon xymon 4.3.14
debian debian linux 8.0

Markus Krell discovered that xymon, a network- and applications-monitoring system, was vulnerable to the following security issues: CVE-2016-2054 The incorrect handling of user-supplied input in the config command can trigger a stack-based buffer overflow, resulting in denial of service (via application crash) or remote code execution CVE-2 ...

Xymon 43x versions suffers from buffer overflow, information disclosure, code execution, cross site scripting, and various other vulnerabilities ...

This module retrieves information from a Xymon daemon service (formerly Hobbit, based on Big Brother), including server configuration information, a list of monitored hosts, and associated client log for each host This module also retrieves usernames and password hashes from the `xymonpasswd` config file fr ...

This module retrieves information from a Xymon daemon service (formerly Hobbit, based on Big Brother), including server configuration information, a list of monitored hosts, and associated client log for each host. This module also retrieves usernames and password hashes from the `xymonpasswd` config file from Xymon servers before 4.3.25, which permit download arbitrary config files (CVE-2016-2055), and servers configured with `ALLOWALLCONFIGFILES` enabled.

msf > use auxiliary/gather/xymon_info
msf auxiliary(xymon_info) > show actions
    ...actions...
msf auxiliary(xymon_info) > set ACTION < action-name >
msf auxiliary(xymon_info) > show options
    ...show and set options...
msf auxiliary(xymon_info) > run

CWE-200 http://www.debian.org/security/2016/dsa-3495 http://packetstormsecurity.com/files/135758/Xymon-4.3.x-Buffer-Overflow-Code-Execution-Information-Disclosure.html https://sourceforge.net/p/xymon/code/7890/http://www.securityfocus.com/archive/1/537522/100/0/threaded https://nvd.nist.gov https://www.debian.org/security/./dsa-3495 https://www.rapid7.com/db/modules/auxiliary/gather/xymon_info

CVE-2016-2055

Vulnerability Summary

Vendor Advisories

Exploits

Metasploit Modules

References

Vulmon Search

About

Products

Connect