Buffer overflow in the redir function in check_http.c in Nagios Plugins before 1.4.10, when running with the -f (follow) option, allows remote web servers to execute arbitrary code via Location header responses (redirects) with a large number of leading "L" characters.

fix possible buffer overflow during HTTP Location header parsing in check_http (CVE-2007-5198) fix possible buffer overflow during snmpget parsing in check_snmp. (CVE-2007-5623)

Upstream released a new version. This also fixes CVE-2007-5198 (#315101).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Mar 18 2008 Tom 'spot' Callaway <tcallawa at     redhat.com> 2.11-3

    - add Requires for versioned perl (libperl.so)

    - get rid of pointless file Requires

    - Mon Mar 17 2008 Mike McGrath <mmcgrath at redhat.com>       2.11-2

    - Upstream released new version

    - Added perl-ExtUtils-Embed

    - Tue Feb 12 2008 Mike McGrath <mmcgrath at redhat.com>       2.10-6

    - Rebuild for gcc43

    - Thu Nov 29 2007 Mike McGrath <mmcgrath at redhat.com>       2.10-5

    - Upstream released 2.10

    - Renamed cfg-sample configs to just .cfg

    - Added BR of perl-devel, libjpeg-devel, libpng-devel

    - Wed Sep 26 2007 Mike McGrath <mmcgrath at redhat.com>       2.9-5

    - rebuild for koji test

    - Sat Sep 8 2007 Mike McGrath <mmcgrath at redhat.com>       2.9-4

    - rebuild

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several local/remote vulnerabilities have been discovered in two of the plugins for the Nagios network monitoring and management system.
The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-5198     A buffer overflow has been discovered in the parser for     HTTP Location headers (present in the check_http     module).

  - CVE-2007-5623     A buffer overflow has been discovered in the check_snmp     module.

fix possible buffer overflow during HTTP Location header parsing in check_http (CVE-2007-5198) fix possible buffer overflow during snmpget parsing in check_snmp (CVE-2007-5623)

Nobuhiro Ban discovered that check_http in nagios-plugins did not properly sanitize its input when following redirection requests. A malicious remote web server could cause a denial of service or possibly execute arbitrary code as the user. (CVE-2007-5198)

Aravind Gottipati discovered that sslutils.c in nagios-plugins did not properly reset pointers to NULL. A malicious remote web server could cause a denial of service.

Aravind Gottipati discovered that check_http in nagios-plugins did not properly calculate how much memory to reallocate when following redirection requests. A malicious remote web server could cause a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200711-11 (Nagios Plugins: Two buffer overflows)

    fabiodds reported a boundary checking error in the 'check_snmp' plugin     when processing SNMP 'GET' replies that could lead to a stack-based     buffer overflow (CVE-2007-5623). Nobuhiro Ban reported a boundary     checking error in the redir() function of the 'check_http' plugin when     processing HTTP 'Location:' header information which might lead to a     buffer overflow (CVE-2007-5198).
  Impact :

    A remote attacker could exploit these vulnerabilities to execute     arbitrary code with the privileges of the user running Nagios or cause     a Denial of Service by (1) sending a specially crafted SNMP 'GET' reply     to the Nagios daemon or (2) sending an overly long string in the     'Location:' header of an HTTP reply. Note that to exploit (2), the     malicious or compromised web server has to be configured in Nagios and     the '-f' (follow) option has to be enabled.
  Workaround :

    There is no known workaround at this time.

A Secunia Advisory reports :

The vulnerability is caused due to a boundary error within the redir() function in check_http.c when processing HTTP Location : header information. This can be exploited to cause a buffer overflow by returning an overly long string in the 'Location:' header to a vulnerable system.

ID	Name	Product	Family	Severity
41162	SuSE9 Security Update : nagios plugins (YOU Patch Number 11953)	Nessus	SuSE Local Security Checks	medium
31981	Fedora 7 : nagios-plugins-1.4.11-2.fc7 (2008-3146)	Nessus	Fedora Local Security Checks	medium
31978	Fedora 8 : nagios-2.11-3.fc8 (2008-3098)	Nessus	Fedora Local Security Checks	medium
31975	Fedora 8 : nagios-plugins-1.4.11-2.fc8 (2008-3061)	Nessus	Fedora Local Security Checks	medium
31055	Debian DSA-1495-1 : nagios-plugins - buffer overflows	Nessus	Debian Local Security Checks	medium
29526	SuSE 10 Security Update : nagios plugins (ZYPP Patch Number 4624)	Nessus	SuSE Local Security Checks	medium
28356	openSUSE 10 Security Update : nagios-plugins (nagios-plugins-4621)	Nessus	SuSE Local Security Checks	medium
28138	Ubuntu 6.06 LTS : nagios-plugins vulnerability (USN-532-1)	Nessus	Ubuntu Local Security Checks	medium
27846	GLSA-200711-11 : Nagios Plugins: Two buffer overflows	Nessus	Gentoo Local Security Checks	medium
27044	FreeBSD : nagios-plugins -- Long Location Header Buffer Overflow Vulnerability (7453c85d-7830-11dc-b4c8-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2007-5198

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium