The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands. NOTE: this issue exists dues to an incomplete fix for CVE-2008-4796.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0214 advisory.

    Nagios is a program that monitors hosts and services on your network, and has the ability to send email or     page alerts when a problem arises or is resolved. Nagios is written in C and designed to run under Linux     (and some other *NIX variants) as a background process, intermittently running checks on various services     that you specify. The actual service checks are performed by separate plugin programs which return the     status of the checks to Nagios. Nagios plugins are available at     http://sourceforge.net/projects/nagiosplug. This package provides the core program, web interface, and     documentation files for Nagios. Development files are built as a separate package.

    Security Fix(es):

    * Various command-execution flaws were found in the Snoopy library included with Nagios. These flaws     allowed remote attackers to execute arbitrary commands by manipulating Nagios HTTP headers.
    (CVE-2008-7313, CVE-2014-5008, CVE-2014-5009)

    * It was found that an attacker who could control the content of an RSS feed could execute code remotely     using the Nagios web interface. This flaw could be used to gain access to the remote system and in some     scenarios control over the system. (CVE-2016-9565)

    * A privileges flaw was found in Nagios where log files were unsafely handled. An attacker who could     control Nagios logging configuration ('nagios' user/group) could exploit the flaw to elevate their access     to that of a privileged user. (CVE-2016-9566)

    Red Hat would like to thank Dawid Golunski for reporting CVE-2016-9565 and CVE-2016-9566.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.

Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.

Various command-execution flaws were found in the Snoopy library included with Nagios. These flaws allowed remote attackers to execute arbitrary commands by manipulating Nagios HTTP headers.

A privilege escalation flaw was found in the way Nagios handled log files. An attacker able to control the Nagios logging configuration (the 'nagios' user/group) could use this flaw to elevate their privileges to root.

Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.

rss-newsfeed.php in Nagios Core 3.4.4, 3.5.1, and earlier, when MAGPIE_CACHE_ON is set to 1, allows local users to overwrite arbitrary files via a symlink attack on /tmp/magpie_cache.

The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs.

The remote host is affected by the vulnerability described in GLSA-201702-26 (Nagios: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Nagios. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local attacker, who either is already Nagios&rsquo;s system user or       belongs to Nagios&rsquo;s group, could potentially escalate privileges.
    In addition, a remote attacker could read or write to arbitrary files by       spoofing a crafted response from the Nagios RSS feed server.
  Workaround :

    There is no known workaround at this time.

It was discovered that missing input sanitizing in Snoopy, a PHP class that simulates a web browser may result in the execution of arbitrary commands.

For the oldoldstable distribution (squeeze-lts), this problem has been fixed in version 2.0.0-1~deb6u1.

We recommend that you upgrade your libphp-snoopy packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
234372	RHEL 7 : nagios (RHSA-2017:0214)	Nessus	Red Hat Local Security Checks	critical
103651	Amazon Linux AMI : nagios (ALAS-2017-899)	Nessus	Amazon Linux Local Security Checks	critical
97269	GLSA-201702-26 : Nagios: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
87112	Debian DLA-357-1 : libphp-snoopy security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2008-7313

critical

Tenable Plugins

critical

critical

critical

critical