Cross-site scripting (XSS) vulnerability in Nagios 2.x before 2.10 allows remote attackers to inject arbitrary web script or HTML via unknown vectors to unspecified CGI scripts.

Several vulnerabilities have been found in nagios2, a host/service/network monitoring and management system. The Common Vulnerabilities and Exposures project identifies the following problems :

Several cross-site scripting issues via several parameters were discovered in the CGI scripts, allowing attackers to inject arbitrary HTML code. In order to cover the different attack vectors, these issues have been assigned CVE-2007-5624, CVE-2007-5803 and CVE-2008-1360.

This update fixes several cross site scripting (XSS) issues in nagios (CVE-2007-5624, CVE-2007-5803, CVE-2008-1360).

This update fixes several cross-site scripting (XSS) issues in nagios.
(CVE-2007-5624 / CVE-2007-5803 / CVE-2008-1360)

- Thu Nov 29 2007 Mike McGrath <mmcgrath at redhat.com>     2.10-5

    - Upstream released 2.10

    - Renamed cfg-sample configs to just .cfg

    - Added BR of perl-devel, libjpeg-devel, libpng-devel

    - Wed Sep 26 2007 Mike McGrath <mmcgrath at redhat.com>       2.9-5

    - rebuild for koji test

    - Sat Sep 8 2007 Mike McGrath <mmcgrath at redhat.com>       2.9-4

    - rebuild

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu Nov 29 2007 Mike McGrath <mmcgrath at redhat.com>     2.10-3

    - Upstream released 2.10

    - Renamed cfg-sample configs to just .cfg

    - Added BR of perl-devel, libjpeg-devel, libpng-devel

    - Wed Sep 26 2007 Mike McGrath <mmcgrath at redhat.com>       2.9-5

    - rebuild for koji test

    - Sat Sep 8 2007 Mike McGrath <mmcgrath at redhat.com>       2.9-4

    - rebuild

    - Wed Aug 22 2007 Mike McGrath <mmcgrath at redhat.com>       2.9-3

    - Rebuild for ppc32 and license

    - Tue Jul 10 2007 Mike McGrath <mmcgrath at redhat.com>       2.9-2

    - Release bump

    - Fri Jun 29 2007 Mike McGrath <mmcgrath at redhat.com>       2.9-1

    - Upstream released 2.9

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
44748	Debian DSA-1883-1 : nagios2 - missing input sanitising	Nessus	Debian Local Security Checks	medium
32117	openSUSE 10 Security Update : nagios (nagios-5168)	Nessus	SuSE Local Security Checks	medium
32116	SuSE 10 Security Update : nagios (ZYPP Patch Number 5165)	Nessus	SuSE Local Security Checks	medium
29271	Fedora 8 : nagios-2.10-5.fc8 (2007-4145)	Nessus	Fedora Local Security Checks	medium
29269	Fedora 7 : nagios-2.10-3.fc7 (2007-4123)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2007-5624

medium

Tenable Plugins

medium

medium

medium

medium

medium