Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-     dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph     function. (CVE-2013-2131)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for rrdtool fixes the following issues :

  - CVE-2013-2131: Added check to the imginfo format to     prevent crash or exploit (boo#828003)

  - Fixed an infinite loop and crashing with pango     [boo#1080251]

This update for rrdtool provides the following fixes :

  - CVE-2013-2131: Enhance imginfo format validation checks     to prevent crashes. (bsc#828003)

  - Add rrdtool-cached sub-package to SLE 12-SP1.
    (bsc#967671)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

rrdtools was updated to add check to the imginfo format to prevent crash or code execution. (bnc#828003, CVE-2013-2131.)

This is an update that adds explicit check to the imginfo format. It may prevent crash/exploit of user space applications which pass user supplied format to the library call without checking.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is an update that adds explicit check to the imginfo format. It may prevent crash/exploit of user space applications which pass user supplied format to the library call without checking. This is an new version of rrdtool that fixes several bugs. The main new feature of this release is that large graph expressions are processed magnitudes faster. For more details see the original announcement http://oss.oetiker.ch/rrdtool/forum.en.html#nabble-f937719

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
254284	Linux Distros Unpatched Vulnerability : CVE-2013-2131	Nessus	Misc.	high
106893	openSUSE Security Update : rrdtool (openSUSE-2018-175)	Nessus	SuSE Local Security Checks	medium
96405	SUSE SLED12 / SLES12 Security Update : rrdtool (SUSE-SU-2017:0103-1)	Nessus	SuSE Local Security Checks	medium
80050	openSUSE Security Update : rrdtool (openSUSE-SU-2014:1646-1)	Nessus	SuSE Local Security Checks	medium
67278	Fedora 18 : rrdtool-1.4.8-2.fc18 (2013-10309)	Nessus	Fedora Local Security Checks	medium
67277	Fedora 19 : rrdtool-1.4.8-2.fc19 (2013-10288)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-2131

high

Tenable Plugins

high

medium

medium

medium

medium

medium