Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before 1.8.4, might allow remote attackers to execute arbitrary code via a long (1) host_name variable (host parameter) or (2) svc_description variable.

The remote host is affected by the vulnerability described in GLSA-201412-23 (Nagios: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Nagios. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to execute arbitrary code, cause a Denial       of Service condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

- fixed Stack based buffer overflow in web interface:
    bnc#797237 - CVE-2012-6096 - icinga-fix-bnc797237.patch

- imported upstream version 1.7.4 - bnc#797237

  - core: add fix for CVE-2012-6096 - history.cgi remote     command execution (Eric Stanley, Markus Frosch) #3532 -     MF

  - core: fix embedded perl segfault #3027 - MF

  - core: fix duplicated events on check scheduling logic     for new events (Andreas Ericsson) #2676 #2993 - MF

  - core: avoid duplicate events when scheduling forced     host|service check (Imri Zvik) #2993 - MF

  - core: get rid of the instame macro usage while logging     alerts and states (Andreas Ericsson) #2665 - MF

  - core: revamp the detection of embedded perl usage     directive '# icinga: +epn' (Andreas Ericsson) #2197 - MF

  - core: fix whitespaces are not stripped using multiple     templates ('use abc, def, ghi') #2701 - MF

  - core: add hint on icinga.cfg package location, and tip     to read Changelog CHANGES on upgrades #2879 - MF

  - core: bail out early with config error if resource.cfg     macros contain NULL values #2879 - MF

  - core: fix logical bug on icinga.cfg detection on config     read #2879 - MF

  - core: fsync() files before fclose() (Andreas Ericsson)     #2948 - MF

  - core: remove weird switch() statement when scanning     checkresult queue (Andreas Ericsson) #2950 - MF

  - core: fix deleting too old check result files (Andreas     Ericsson) #2951 - MF

  - idoutils: fix IDOUtils on PostgreSQL, recreates service     objects in icinga_objects (thx Torsten Fohrer) #3166 -     MF

  - idoutils: fix icinga mysql db creation script grants     access to all dbs #2917 - MF

  - idoutils: fix ignoring mysql password in     create_mysqldb.sh #2994 - MF

  - removed obsolete patches

- avoid stack based buffer overflow in web interface     (history): added nagios-history_buffer_overflow.patch -     (bnc#797237) fixes CVE-2012-6096

It was discovered that Icinga, a host and network monitoring system, contains several buffer overflows in the history.cgi CGI program.

This update fixes a stack overflow in the nagios web interface.
CVE-2012-6096 has been assigned.

This update fixes a stack overflow in nagios web interface.
CVE-2012-6096 has been assigned.

A buffer overflow problem has been found in nagios3, a host/service/network monitoring and management system. A malicious client could craft a request to history.cgi and cause application crashes.

Update to 3.4.4; CVE-2012-6096

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote web server hosts a version of Nagios Core that is affected by a buffer overflow vulnerability.  By sending a specially crafted request using the 'host_name' or 'svc_description' parameter to 'history.cgi', a remote attacker may be able to execute arbitrary code or trigger a denial of service condition.

full disclosure reports :

history.cgi is vulnerable to a buffer overflow due to the use of sprintf with user-supplied data that has not been restricted in size.

ID	Name	Product	Family	Severity
79976	GLSA-201412-23 : Nagios: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
75069	openSUSE Security Update : icinga (openSUSE-SU-2013:0206-1)	Nessus	SuSE Local Security Checks	high
75020	openSUSE Security Update : icinga (openSUSE-SU-2013:0169-1)	Nessus	SuSE Local Security Checks	high
74997	openSUSE Security Update : nagios (openSUSE-SU-2013:0140-1)	Nessus	SuSE Local Security Checks	high
65696	Debian DSA-2653-1 : icinga - buffer overflow	Nessus	Debian Local Security Checks	high
64927	SuSE 10 Security Update : nagios (ZYPP Patch Number 8460)	Nessus	SuSE Local Security Checks	high
64926	SuSE 11.2 Security Update : nagios (SAT Patch Number 7328)	Nessus	SuSE Local Security Checks	high
64439	Debian DSA-2616-1 : nagios3 - buffer overflow in CGI scripts	Nessus	Debian Local Security Checks	high
63660	Fedora 17 : nagios-3.4.4-1.fc17 (2013-0753)	Nessus	Fedora Local Security Checks	high
63659	Fedora 16 : nagios-3.4.4-1.fc16 (2013-0752)	Nessus	Fedora Local Security Checks	high
63658	Fedora 18 : nagios-3.4.4-1.fc18 (2013-0732)	Nessus	Fedora Local Security Checks	high
63563	Nagios Core history.cgi Multiple Parameter Buffer Overflow	Nessus	CGI abuses	high
63470	FreeBSD : nagios -- buffer overflow in history.cgi (97c22a94-5b8b-11e2-b131-000c299b62e1)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2012-6096

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high