Buffer overflow in the check_snmp function in Nagios Plugins (nagios-plugins) 1.4.10 allows remote attackers to cause a denial of service (crash) via crafted snmpget replies.

fix possible buffer overflow during HTTP Location header parsing in check_http (CVE-2007-5198) fix possible buffer overflow during snmpget parsing in check_snmp. (CVE-2007-5623)

Several local/remote vulnerabilities have been discovered in two of the plugins for the Nagios network monitoring and management system.
The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-5198     A buffer overflow has been discovered in the parser for     HTTP Location headers (present in the check_http     module).

  - CVE-2007-5623     A buffer overflow has been discovered in the check_snmp     module.

fix possible buffer overflow during HTTP Location header parsing in check_http (CVE-2007-5198) fix possible buffer overflow during snmpget parsing in check_snmp (CVE-2007-5623)

The remote host is affected by the vulnerability described in GLSA-200711-11 (Nagios Plugins: Two buffer overflows)

    fabiodds reported a boundary checking error in the 'check_snmp' plugin     when processing SNMP 'GET' replies that could lead to a stack-based     buffer overflow (CVE-2007-5623). Nobuhiro Ban reported a boundary     checking error in the redir() function of the 'check_http' plugin when     processing HTTP 'Location:' header information which might lead to a     buffer overflow (CVE-2007-5198).
  Impact :

    A remote attacker could exploit these vulnerabilities to execute     arbitrary code with the privileges of the user running Nagios or cause     a Denial of Service by (1) sending a specially crafted SNMP 'GET' reply     to the Nagios daemon or (2) sending an overly long string in the     'Location:' header of an HTTP reply. Note that to exploit (2), the     malicious or compromised web server has to be configured in Nagios and     the '-f' (follow) option has to be enabled.
  Workaround :

    There is no known workaround at this time.

- Fri Oct 26 2007 Mike McGrath <mmcgrath at redhat.com>     1.4.8-9

    - Fix for Bug 348731 and CVE-2007-5623

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Oct 26 2007 Mike McGrath <mmcgrath at redhat.com>     1.4.8-9

    - Fix for Bug 348731 and CVE-2007-5623

    - Wed Aug 22 2007 Mike McGrath <mmcgrath at redhat.com>       1.4.8-7

    - Rebuild for BuildID

    - License change

    - Fri Aug 10 2007 Mike McGrath <mmcgrath at redhat.com>       1.4.8-6

    - Fix for check_linux_raid - #234416

    - Fix for check_ide_disk - #251635

    - Tue Aug 7 2007 Mike McGrath <mmcgrath at redhat.com>       1.4.8-2

    - Fix for check_smtp - #251049

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
41162	SuSE9 Security Update : nagios plugins (YOU Patch Number 11953)	Nessus	SuSE Local Security Checks	medium
31055	Debian DSA-1495-1 : nagios-plugins - buffer overflows	Nessus	Debian Local Security Checks	medium
29526	SuSE 10 Security Update : nagios plugins (ZYPP Patch Number 4624)	Nessus	SuSE Local Security Checks	medium
28356	openSUSE 10 Security Update : nagios-plugins (nagios-plugins-4621)	Nessus	SuSE Local Security Checks	medium
27846	GLSA-200711-11 : Nagios Plugins: Two buffer overflows	Nessus	Gentoo Local Security Checks	medium
27811	Fedora 8 : nagios-plugins-1.4.8-9.fc8 (2007-2876)	Nessus	Fedora Local Security Checks	medium
27795	Fedora 7 : nagios-plugins-1.4.8-9.fc7 (2007-2713)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2007-5623

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium